Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

48a776e5ef...a9.xls

windows7-x64

10

48a776e5ef...a9.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2024, 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9.xls

  • Size

    192KB

  • MD5

    054c7c9df65480b67c1762fdf1071692

  • SHA1

    e9962aa07b013c9d2f56a257f08c3873919c57bf

  • SHA256

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9

  • SHA512

    54403bb19f320a9e7c241ba28f9c0b2b67b9beb8585ab13a9e434a6edf9d4bfbd99047710197f784d685879b6af2929574a5e00347b406dcd2493244b12ac3ad

  • SSDEEP

    3072:PrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:zxEtjPOtioVjDGUU1qfDlavx+W2QnAqE

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:2276
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3136
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1596
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            PID:5000
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 80
              6⤵
              • Program crash
              PID:4084
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1704
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBEB.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:968
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 5000
    1⤵
      PID:4564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
      Filesize

      717B

      MD5

      822467b728b7a66b081c91795373789a

      SHA1

      d8f2f02e1eef62485a9feffd59ce837511749865

      SHA256

      af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

      SHA512

      bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EC004B7FD8CB72D80A747F531B799BC
      Filesize

      504B

      MD5

      468c10fe6e033605fdc3eb77dac1a0b9

      SHA1

      f2afc12dc5c537c067334987f42d0e23457d50ae

      SHA256

      6f1ccbff6df00d9812182caa9e98b2ceea1f056527efff69f28f38b1fac8b817

      SHA512

      7e08a6d72c7d809edd92fe4560008f69fd98d2f0d802bea341acb6ef6fb7beb073e953b838a735761ea0d081749982bb16426e322923596feed78d08ad79e77d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      471B

      MD5

      e81d1a452656da5266f453cb1a0fbcd4

      SHA1

      142b115501d7af306d8f887be66bc89e92e81521

      SHA256

      0a36be52eebc55142cc433203364f79cbe29bef5a6d0ce4bbf04fa41656de368

      SHA512

      4f782226101f3d628a7853c1ed828b16acd3fded03b3dc3329a68f3cf6f1c2c8a9748ff4abd5970c74244a7656eeafd2f3041743a8961ad0fced2843f2cbc987

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
      Filesize

      192B

      MD5

      d81cd1a056e71cea259f00d664693127

      SHA1

      f04f1e1adfd2c7a772c50f4f6f051d0a200c613d

      SHA256

      0915ae501c5192ab62dd0095d8c19ea1dccfab2f53d8a235b26768c76a5fb55f

      SHA512

      be886ac7b9cf8cb9daf348206c4169ffbe737fafec83e0511edd959ac4948a7bac6c8289a01be5ca67e4799150f91f6b218d408c78cd9a754119374976cde22d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EC004B7FD8CB72D80A747F531B799BC
      Filesize

      546B

      MD5

      59c2fd1fbdc29ba785f09a06d56baaef

      SHA1

      6e27db6ecae608f0954a8ef63dc18d3b1f6be5fa

      SHA256

      5ae0f641ad0499e0449c85e0531b4acd8d14665cc34b6490632efa8f63f5d0ae

      SHA512

      167eba88cb329673a86e0f23bdb8b35eee13b1c6397d6f3fad747f032c079b7b7912b4697392c6baf1aa641e14e7657d4126d71f5bd85d9e867cd62ceaeef4e1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      412B

      MD5

      ad311dc6b033a65e75e10b9af0020c5d

      SHA1

      b791842f54b610636de0a3c927db2e21e6543875

      SHA256

      a51c80ad0b5e84dcd66ac9d891a698251a77790945000a933a75f8fcf55e2934

      SHA512

      0107ae974a7f13ff2d72228b3e1155f9716598f03a4eac3c9bd3ca9b6d25a5d9e4ef5e3ed92bb8a2f640049686d495c5d363398046587fa6d2e49141a251c47f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GFKMTE.exe.log
      Filesize

      706B

      MD5

      d95c58e609838928f0f49837cab7dfd2

      SHA1

      55e7139a1e3899195b92ed8771d1ca2c7d53c916

      SHA256

      0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

      SHA512

      405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4F619157-E429-49C5-A384-6FC2506BAE42
      Filesize

      176KB

      MD5

      6e9e1da95319b5911bd2dbe5145d216e

      SHA1

      bf50c2b9c0878138c1df5471f2174d8161300b9e

      SHA256

      47e4c85a41da9e4ff56e41784258e85e720da61138b35dba29e3634a09cd5f23

      SHA512

      1f6f8805f02c2b15ae74013a5f4d2dcdafe943878f27b98b7a5dc84fddb5987ca6d60c6d88f42742f944ee88895b77471a7bee5acba81503fa7ba7fcd47e71df

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
      Filesize

      11KB

      MD5

      fe14c6b4f2f681fb08bce52eb8fa74e7

      SHA1

      576eb1068d95345c2e696de88a30dd0548feb079

      SHA256

      689649ff665d061888fa299e9b7f5f77e7a888524d087455efbafa4de3ea9796

      SHA512

      1565037bafa3f4e4fcd3badd6100d29fd781accc519a051daedc6079ba61a8dc3d7a2425540b41af01922be78724c3757b08e1de792ebcd901612339d7dcffe2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
      Filesize

      2KB

      MD5

      5806ab2551ed027b77b13cfc449c0d4c

      SHA1

      441085147973107e0a3143300e26bef668c8df17

      SHA256

      ec003d311eea477b8f5c740bbc97d6d1052cd8bf84aa349f5d621328bc21718b

      SHA512

      1a9d44fd86f528c04ecc1853999b9dcd5e041d687ebd13d920b147b5087e491b6be70e237b1267a3f67781c3918e48e882b539b80764440adb4429196a05065b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
      Filesize

      2KB

      MD5

      09504ddbd58c6393b45dd7dab6b8b842

      SHA1

      d395645bede0c5f320dcb64957492f605259cce4

      SHA256

      c18c1787f76e828ee613296e460f59161764357d59a074b8b1f13cff511132ef

      SHA512

      ae79f27f3c3dc13e0f3abc61c33cc9e1c8fd83a8db7ca2ad54b6927df5562925127c842d2ef332ba00fb904a83478803e4f375e6019232479bc50ee229b8cf49

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TCDD077.tmp\gb.xsl
      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmpCBEB.tmp
      Filesize

      1KB

      MD5

      dabe93a03c5560ab1670cf79b8d28566

      SHA1

      69738fe43d4550ece028ff2795a54bbad0985414

      SHA256

      743e8b28a38e98ea27ef07f17b7529976979c7b01eab92586a6cb686c0d1f68d

      SHA512

      15b3b49c46901e00a73def834225df28fd843af1e9ae594c7d061406209f6ce57277673c9c1ae3ed541f989fa499fd3e88929e00ebded6d23301f8d3680a6c57

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\¸¸.doc
      Filesize

      195KB

      MD5

      7ea9da3dd3db6f3fadf04ac76b54434b

      SHA1

      b30b950191046d999e71aaa54fb2648c6655ce9b

      SHA256

      947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170

      SHA512

      f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
      Filesize

      1KB

      MD5

      85e5c3971c535dd3e2abeedcdc0fef2e

      SHA1

      3868760f3648ff3a2a16b6f9cf212982cd8c28ee

      SHA256

      9892ae01b0404ec3bf5b5affe47483d1c6b3bee99b2a40a34a4d1bcb1c91f252

      SHA512

      532f7afb94ca0ccdef325343f4583325cb2b1ab81848b1d2b2d1ff4d9b35dba6e99b4b7e06176303a969d3b20734b34f8dc2731141424e2a2fff5c05114a3b80

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      Filesize

      166KB

      MD5

      57fcc042b0f7783567878d217ae69e25

      SHA1

      83032ec361ea8b15ef956536999b754db6a12423

      SHA256

      13bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564

      SHA512

      4fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs
      Filesize

      10KB

      MD5

      087bcef76143b81090deef4ee4679995

      SHA1

      6ebd4fd212d0583157ae03bb0eb5841c53e281fc

      SHA256

      87334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00

      SHA512

      b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d

      Download Submit

    • memory/1124-10-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-113-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-17-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-16-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-36-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-40-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-42-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-43-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-55-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-20-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-18-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-15-0x00007FFBD2A90000-0x00007FFBD2AA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-0-0x00007FFBD4C90000-0x00007FFBD4CA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-71-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-14-0x00007FFBD2A90000-0x00007FFBD2AA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-11-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-12-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-13-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-6-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-7-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-111-0x00007FFC14CAD000-0x00007FFC14CAE000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1124-19-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-9-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-3-0x00007FFBD4C90000-0x00007FFBD4CA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-2-0x00007FFBD4C90000-0x00007FFBD4CA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-1-0x00007FFC14CAD000-0x00007FFC14CAE000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1124-5-0x00007FFBD4C90000-0x00007FFBD4CA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-8-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-171-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-170-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-139-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-166-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1124-4-0x00007FFBD4C90000-0x00007FFBD4CA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1124-165-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2284-140-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

      Download

    • memory/3652-138-0x0000000004D80000-0x0000000004D86000-memory.dmp

      Filesize

      24KB

      Download

    • memory/3652-137-0x000000000A2A0000-0x000000000A332000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3652-136-0x000000000A850000-0x000000000ADF4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3652-135-0x000000000A200000-0x000000000A29C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/3652-134-0x00000000026E0000-0x0000000002712000-memory.dmp

      Filesize

      200KB

      Download

    • memory/3652-133-0x00000000026D0000-0x00000000026D6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/3652-132-0x0000000000270000-0x00000000002A0000-memory.dmp

      Filesize

      192KB

      Download