xworm | 6f7de381f35a662b0dc78422c670bc02ea0ea90ea8565d577d938d9ac296b239

Resubmissions

01/03/2025, 13:43

250301-q1fsrassg1 10

01/03/2025, 13:39

250301-qxxxvsssdt 10

Analysis

max time kernel
73s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperNew.exe
Size

68KB
MD5

ba06c09b1c72827d265103eb77ec4e51
SHA1

1248cc8e569ba391e556a978a4c525facf98f1de
SHA256

6f7de381f35a662b0dc78422c670bc02ea0ea90ea8565d577d938d9ac296b239
SHA512

8bdf160406cc6e43fa45098ad732fc59e600d72274ed50471745a9ecc0fee33b4d188e83559b71fa8c40e6ca8997b7c0fe1c4553ccd7e80657a6cce4c9b5cf89
SSDEEP

1536:79uMdFE7rHp4xOXyPE9npfUW/boDmuk62fMDO/OzS:7E7e1uUW/boDwfMDO/mS

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

anti-dude.gl.at.ply.gg:33648

Attributes

Install_directory
%AppData%
install_file
System.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1100-1-0x0000000000AF0000-0x0000000000B08000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fad3d400b08adb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1f71901b08adb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c29e5d00b08adb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000246a6d01b08adb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dafae00b08adb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a9f3e00b08adb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030ef2d00b08adb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	BootstrapperNew.exe
Token: 33	548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	548	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2140	548	SearchIndexer.exe	105
PID 548 wrote to memory of 2140	548	SearchIndexer.exe	105
PID 548 wrote to memory of 4988	548	SearchIndexer.exe	106
PID 548 wrote to memory of 4988	548	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5072

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2140
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-4-0x000001F103720000-0x000001F103730000-memory.dmp

Filesize
64KB

Download
memory/548-20-0x000001F103940000-0x000001F103950000-memory.dmp

Filesize
64KB

Download
memory/548-36-0x000001F107D00000-0x000001F107D08000-memory.dmp

Filesize
32KB

Download
memory/548-40-0x000001F109400000-0x000001F109408000-memory.dmp

Filesize
32KB

Download
memory/1100-0-0x00007FF980173000-0x00007FF980175000-memory.dmp

Filesize
8KB

Download
memory/1100-1-0x0000000000AF0000-0x0000000000B08000-memory.dmp

Filesize
96KB

Download
memory/1100-2-0x00007FF980170000-0x00007FF980C31000-memory.dmp

Filesize
10.8MB

Download
memory/1100-3-0x00007FF980170000-0x00007FF980C31000-memory.dmp

Filesize
10.8MB

Download
memory/4988-52-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-54-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-44-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-47-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-46-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-45-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-48-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-49-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-50-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-53-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-42-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-51-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-55-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-57-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-56-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-43-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-58-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-60-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-71-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-70-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-69-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-68-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-67-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-66-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-65-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-64-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-63-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-62-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-61-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download
memory/4988-59-0x0000021CA2890000-0x0000021CA28A0000-memory.dmp

Filesize
64KB

Download