xworm | cb0c7cc189c3d6e549323887c5baec9cfe91252da69a2aaf3d7dfff07c7f6806

Analysis

max time kernel
107s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2025, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kunzi/KunziSpoofer.exe
Size

76KB
MD5

5d15d2ea7e1adf32489a73cc4a1b8a6d
SHA1

0a2e7b7f8d67c0ffb2b80d68657baaf1593ca8cd
SHA256

24ef64893177dcdb3b5156143b3d59d95857585508269cdbf24ad831dfad2747
SHA512

f72ee020c560d3d5cc8afc1244022d41557f67b63b16c312324d444c31096fa8362d827960ee32a5da1d9615017b32a8a2f7f30192d894fae431465bd8deb58d
SSDEEP

768:ta0mWhFFObZnFabjsQZzzUN0SHtZ4vXMbwSDgXTDaoba6HJxtqzzO8v38Jh+cag8:tajyj3FzQltZ6cbwvTDo6JyO8vIFaBD

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

defined-literary.gl.at.ply.gg:39055

Attributes

Install_directory
%LocalAppData%

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4704-1-0x00000000008D0000-0x00000000008EA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
3428	msedge.exe
3428	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe
896	msedge.exe
896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	KunziSpoofer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
956	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2844	4952	msedge.exe	90
PID 4952 wrote to memory of 2844	4952	msedge.exe	90
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 4456	4952	msedge.exe	91
PID 4952 wrote to memory of 3428	4952	msedge.exe	92
PID 4952 wrote to memory of 3428	4952	msedge.exe	92
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93
PID 4952 wrote to memory of 1608	4952	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Kunzi\KunziSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Kunzi\KunziSpoofer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e0863cb8,0x7ff9e0863cc8,0x7ff9e0863cd8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,2747023170767065514,7046213456207095330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe073f7cd46dc621114e4f8757336cc

SHA1
2063f15f773ff434b375a1fe4c593bc91b31f2e0

SHA256
e54fed17731c51a64a17e37dc2511159e55b308f0a67939477494c15166ebffd

SHA512
bfe0b1bb10d93def5ed5104e8aac1d74991de2ad64042ebcb35ad43e3dc3bfdb47d126a3c6632238e68c8e227187ba05f81192b50843162134222446fdb0b25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b98903eec4d4ba62d58ef15c040a098c

SHA1
edbfd3947a194ddd1ee2e2edb465eb7a57f27cb3

SHA256
698d9fcc6775ee16a41017cf13ccd9614001c681b8a4da741a1851f1b9f48def

SHA512
ee53739c6c098c48a594768bbbbada27d9728034b85e0e67220be097007348162f257a31f0669bcd17ba142b10b110680c3b5b18f9c40b37e5fa1fe8124d27e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c47e4bd46ca8e17605605cd19005cd87

SHA1
ce7ef18da2cea5a6f1e2094c65180089e82744a1

SHA256
d05e129842c6e57d14b886ed63a55dc85c0eab79cbd693404b874c06e0046cc9

SHA512
cab878f61c0fdda51c990e9436a4ec01f98dd3f807107ec10177182e864e2a432c0615fc4f74f448322c9b1808e3409d75f7c502ba3dd52b247b901bca7f84c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fced7cfc085c42a37d05bccf0c2b65d

SHA1
506cd20f5036400407b4a4a3bb25bfa8e5699ba5

SHA256
9c3a199efd408fc3048972d05027bc4cf0df522303645e895aaeb3bd4de7fcc8

SHA512
943b1dd639708c294641bf1c27f08ca2936b9566b6b92608703d02698753409b9226030aec52f2e4925218964383b96e74ff6dab838e7a8292c31a3a37587c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea52486e0da1c63e845650bcdaec5c6e

SHA1
783ebaee1806d8d9248fbc97658d50844f4117ee

SHA256
17bb2515038aad758a7338048093c4268ef2abd45a52ee26e37fa48b0b61a828

SHA512
ccf512e9fbe72fd35cf7bca79741d2f23c6de118da93d248be39869f0b120b1129c492f6425fe901433d333473e01a7fb5d3d08e0b000dbb1835e4c12ba2d7c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
25KB

MD5
5417b341b1d2d5c87bbaf74821ff593f

SHA1
acafa0fde967d4b2ada5f1c72d77b00e8a3e75dc

SHA256
9733014a1bf6a19dec391c542adffdca2102fb4ebf92c7086ff7ea92b3b00fe5

SHA512
6c6948c81f5804d7a2b5db9c4c1a12f9d81ed74173baf3ea3f685a36b531b19ed47d0ce2f391b42b6182eefae204ccc97bc63c611c4b375fc3350174da4700fa

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
25KB

MD5
f077b9aa241b236876c96e8f909b47d5

SHA1
41b14b8927e3085117828d6c4ca6b92b59786eb9

SHA256
73a07bbadcc6963ea17d8923bc3ea2deb92d96dc6482de6474f73f47d6afb886

SHA512
d0839db34f11a283c507559a144ef50c2e6fc555e7999f5314891774a51ce4aa83edabb1554f1e59a8332f89d4126e3e259f5d7a3e459728c06a7c15276b6bdc

Download Submit
memory/4704-2-0x00007FF9CF4D0000-0x00007FF9CFF92000-memory.dmp

Filesize
10.8MB

Download
memory/4704-3-0x00007FF9CF4D0000-0x00007FF9CFF92000-memory.dmp

Filesize
10.8MB

Download
memory/4704-1-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/4704-0-0x00007FF9CF4D3000-0x00007FF9CF4D5000-memory.dmp

Filesize
8KB

Download