Overview

overview

10

Static

static

8

48a776e5ef...a9.xls

windows7-x64

10

48a776e5ef...a9.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 21:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9.xls

  • Size

    192KB

  • MD5

    054c7c9df65480b67c1762fdf1071692

  • SHA1

    e9962aa07b013c9d2f56a257f08c3873919c57bf

  • SHA256

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9

  • SHA512

    54403bb19f320a9e7c241ba28f9c0b2b67b9beb8585ab13a9e434a6edf9d4bfbd99047710197f784d685879b6af2929574a5e00347b406dcd2493244b12ac3ad

  • SSDEEP

    3072:PrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:zxEtjPOtioVjDGUU1qfDlavx+W2QnAqE

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:1940
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        PID:3672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 80
          4⤵
          • Program crash
          PID:2780
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC25.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3304
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4416
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2032
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            PID:4496
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 80
              6⤵
              • Program crash
              PID:4556
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3276
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
    1⤵
      PID:1012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4496 -ip 4496
      1⤵
        PID:2484

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        Filesize

        717B

        MD5

        822467b728b7a66b081c91795373789a

        SHA1

        d8f2f02e1eef62485a9feffd59ce837511749865

        SHA256

        af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

        SHA512

        bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EC004B7FD8CB72D80A747F531B799BC
        Filesize

        504B

        MD5

        468c10fe6e033605fdc3eb77dac1a0b9

        SHA1

        f2afc12dc5c537c067334987f42d0e23457d50ae

        SHA256

        6f1ccbff6df00d9812182caa9e98b2ceea1f056527efff69f28f38b1fac8b817

        SHA512

        7e08a6d72c7d809edd92fe4560008f69fd98d2f0d802bea341acb6ef6fb7beb073e953b838a735761ea0d081749982bb16426e322923596feed78d08ad79e77d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        471B

        MD5

        b51ec1bb8e0b2545ab3f8edd052142fc

        SHA1

        2b01f53f310e9924c290b045804475401062357e

        SHA256

        3a1146c1f4bf199350370cbac825d792895128cda813fed5020df57d0935def1

        SHA512

        00341b3a3d843c8647eb9e96153db3f1792acba43fe394d9d2aee536e597ef8c492fb1e3f6616bc5aff99b106e71b2fdc335f425ac1405cd432e221fdbde5ac9

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        Filesize

        192B

        MD5

        a219f30f71d7fdfb1a3056f67fc0ca9f

        SHA1

        5148c84948904df7db3a01950f6daf7e3246c6ad

        SHA256

        b02f4bb1db12abe50fb24a2eb68a1abbc73247f168b8043cbdcaa048755c1526

        SHA512

        cb7abf953671e5c6a8f079bd0447227dde1bc862e3dd5d70cee5b16efcfb1f4874baee9f28054c4aa2acb31b079e19834d6dbdeb943603ac77cc659683157c3e

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EC004B7FD8CB72D80A747F531B799BC
        Filesize

        546B

        MD5

        56c8981097c15fef1d558930d176ba34

        SHA1

        50c76f328e2d5558ce6931223554a17791ee165a

        SHA256

        8fa0e8f49aa63b167be0d5175ff839401ccc4d54e0b97e627a7e9b76ecfe8ec4

        SHA512

        a71bd6d0e6a87e85ede2d44dd67d498c3d94c8ed12ea667f79fcdc7ef8c74d32288ef6c6780038917e0506d7efceaeb28316ff5d6c80de9f090e8b6c48ba4cff

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        420B

        MD5

        b02cf0d93c809a9b92c7749c4623edc9

        SHA1

        b4e24323ca769061c7c4f96db472a3b3dca1c776

        SHA256

        04fb86de701f0861f5d09e20ed80b9e7f0239ed913799657d5333d92b5ed3593

        SHA512

        c8e32ba5ba75ba0eef59c7de23b3d81590d32e111b02cfa271db491ab5f01573f662be6c2de3fcd830bd2d7a260b46dd032c54eee1cf19a3f7948335e1f24080

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GFKMTE.exe.log
        Filesize

        706B

        MD5

        d95c58e609838928f0f49837cab7dfd2

        SHA1

        55e7139a1e3899195b92ed8771d1ca2c7d53c916

        SHA256

        0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

        SHA512

        405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E7F7409B-8F52-4F19-94BB-3761FBE799C9
        Filesize

        176KB

        MD5

        8d17a013300ffa0d9c877eaf724ce7d0

        SHA1

        c523676d222c867e212fb91f6e40d8e096861053

        SHA256

        1605e801ab89674f84b3e21aac3dbdf100e712aaaf2882c454c0abd95ccc409d

        SHA512

        ce0f073bfa0b2195498dceb0da4be810c3d2ad1847c6612f23f4e5fb1cecb21b12e41218ae84a7dc89328dfda9ea382f506b16fa150bfb2d0ebe3c2b067c97c9

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
        Filesize

        10KB

        MD5

        d9566285ce87ae4e4d79ae96685b4d1e

        SHA1

        46b54655376d3f2cf5aaf53f03b0e8ebccdc17ca

        SHA256

        89d1b108b06f3c480b780a4397b34b2c990a6177488f0e34a934e04a74841311

        SHA512

        949dfcb72c5e9c4e51ffaa0f4cb2f294cdc4bfedf9ab6d6997692966aa09a2b0f99bc7fc492c6b47ffeb7553cf29ae175558d84a1ac836d1c04b29f4912bc81f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
        Filesize

        2KB

        MD5

        f1da150f4e9898a8aa80e15b6b536533

        SHA1

        efc1ed8322340293f66c31379f7ee9001b2244b1

        SHA256

        b0c46216997099743660e2c00cb684832f8386349997b56f51f537a873d7ef47

        SHA512

        554107290ace1effd1c57a5923d28a42e46362163140a6a1c1655475773d1904bcc8382fc03d496cbd6a7114fc0228f83fc0c114291b3d0f17ff527b91c623ad

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
        Filesize

        2KB

        MD5

        9e104d1380d39fb9b1c88ef77a05444e

        SHA1

        84a5e0314dc5fa6732c60b4cc2bf2b5d31862f1c

        SHA256

        f392561c2c0087554688cd1863aed5780a97ff635060cde67ecb15d8ecdd8ed1

        SHA512

        79507a01079697c4d8c5b1aff54fc299c6a962bce098e93460090d48ce553b193085065dac94f9a992e393764897c3a2e084d32c7bc034bb26975aa73e7e77e8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TCDF08C.tmp\sist02.xsl
        Filesize

        245KB

        MD5

        f883b260a8d67082ea895c14bf56dd56

        SHA1

        7954565c1f243d46ad3b1e2f1baf3281451fc14b

        SHA256

        ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

        SHA512

        d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpEC25.tmp
        Filesize

        1KB

        MD5

        dabe93a03c5560ab1670cf79b8d28566

        SHA1

        69738fe43d4550ece028ff2795a54bbad0985414

        SHA256

        743e8b28a38e98ea27ef07f17b7529976979c7b01eab92586a6cb686c0d1f68d

        SHA512

        15b3b49c46901e00a73def834225df28fd843af1e9ae594c7d061406209f6ce57277673c9c1ae3ed541f989fa499fd3e88929e00ebded6d23301f8d3680a6c57

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\¸¸.doc
        Filesize

        195KB

        MD5

        7ea9da3dd3db6f3fadf04ac76b54434b

        SHA1

        b30b950191046d999e71aaa54fb2648c6655ce9b

        SHA256

        947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170

        SHA512

        f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
        Filesize

        1KB

        MD5

        bc46413561865400173b7ec0ee591a95

        SHA1

        8eba474ca91bf36a4e93ae918f0dbd78f93f45b6

        SHA256

        563ce36bbfac5a0c1b1f55e68ce9efae199192d27a058d268a30b0b3d0095ec3

        SHA512

        fe19192ddba215d2612b91dd129a7922192afc9e0b41bab410367bd3db3eb525442949ddaa8d53ab402f637a709d4b5a6b15e40cfcbe7aebbe5d8878c6e218d4

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        Filesize

        166KB

        MD5

        57fcc042b0f7783567878d217ae69e25

        SHA1

        83032ec361ea8b15ef956536999b754db6a12423

        SHA256

        13bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564

        SHA512

        4fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs
        Filesize

        10KB

        MD5

        087bcef76143b81090deef4ee4679995

        SHA1

        6ebd4fd212d0583157ae03bb0eb5841c53e281fc

        SHA256

        87334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00

        SHA512

        b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d

        Download Submit

      • memory/1000-131-0x000000000ADC0000-0x000000000AE5C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/1000-128-0x0000000000E80000-0x0000000000EB0000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1000-134-0x000000000AD20000-0x000000000AD26000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1000-133-0x000000000AE60000-0x000000000AEF2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1000-132-0x000000000B410000-0x000000000B9B4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1000-130-0x00000000057E0000-0x0000000005812000-memory.dmp

        Filesize

        200KB

        Download

      • memory/1000-129-0x0000000001920000-0x0000000001926000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2356-69-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-0-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-17-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-31-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-15-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-16-0x00007FF7DEA90000-0x00007FF7DEAA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-11-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-13-0x00007FF7DEA90000-0x00007FF7DEAA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-12-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-10-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-124-0x00007FF820F2D000-0x00007FF820F2E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2356-125-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-9-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-6-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-5-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-14-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-38-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-33-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-32-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-1-0x00007FF820F2D000-0x00007FF820F2E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2356-8-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-144-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-160-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-164-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-165-0x00007FF820E90000-0x00007FF821085000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2356-7-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-2-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-3-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2356-4-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4388-137-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download