Overview

overview

10

Static

static

af03b1a302...aa.exe

windows7_x64

10

af03b1a302...aa.exe

windows10_x64

10

Analysis

  • max time kernel
    109s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-01-2021 14:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe

  • Size

    66KB

  • MD5

    1b033111b8923c12f1d84e09769806f5

  • SHA1

    2ab84be1752574bac3ad0f9a8f9107fa5657033a

  • SHA256

    af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa

  • SHA512

    2c47a5121eb0cd965f29b934a2a8536da7245eee42c7e66987410b537240f502a4b94263423ced8600be9a6fa61540bb218d4fa9f2213b888b28f0e331462c9c

Score
10/10
ransomwarespyware

Malware Config

Extracted

Path

C:\8D9DA2-Readme.txt

Ransom Note
Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\8D9DA2-Readme.txt

Ransom Note
Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files\Google\Chrome\Application\86.0.4240.111\8D9DA2-Readme.txt

Ransom Note
Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}Hi! Your files are encrypted. All files for this computer has extension: .8d9da2 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_8d9da2: uha3fmJMXs9V/DqycSH3mQbCVVCsihjve3AGjuVRjablSgewXO 2EUCAf0nSpFsVa5N/mKGkAvLbiKp2QfJCTz0sWWsafZB95t/DL dPSinY360TaeeWzJgVTs26k2cl1sNldtO4G8vUpnbkb5QGnmpN jd54sizOYmx1PHd2ZlM3qOy8a/xJZQGRy3E2uBo5SSq3DL2ROO NckObUHgW5aXHIUs5kOJbGVGgdL3CFkMUkMyHScpSE0PTdqJt8 qH/yyIh7yBzJt2fgCO5xji6vSI2kyHfENIB5sMKQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in Program Files directory 19576 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 15598 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe
    "C:\Users\Admin\AppData\Local\Temp\af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\SysWOW64\notepad.exe
      C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\8D9DA2-Readme.txt"
      2⤵
        PID:3400
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7178.tmp.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:7796
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /PID 1308
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5320

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7178.tmp.bat
      MD5

      05ddd71e6fa01385c29305d7faf00386

      SHA1

      2562b52dac0de2438a481931ad16a9f109e12992

      SHA256

      4f7960026c4b7c01f3f6f68bb2a120c7293301536f1c5c64ad7b22e9ea852a3c

      SHA512

      271765bcceca2c67d1c14100d4908920c2657484775b0c09fb348326e44b35a70eaadd26765ab092a676719620b0a4ef2e91a40c09b7559a3bd1a32072886061

      Download Submit
    • C:\Users\Admin\Desktop\8D9DA2-Readme.txt
      MD5

      8d1193a786e5889f661da29c740b41b5

      SHA1

      08dda8bf664f790158ced1a02f36ab6fa705102a

      SHA256

      d582f114316d85118a936d8fc5b15b3e57d269b8ec9db2f9b66a9e3ca2ea878a

      SHA512

      fe1a4c0d4b2f07c1fcb28a274629f7a771bf1ec4aeb3e54ad6aae524687c78d0072ae58c44481d07a53677fac2893b61c9a9021ce708a2a5bf7fe1a73cce2e0b

      Download Submit
    • memory/3400-2-0x0000000000000000-mapping.dmp
      Download
    • memory/5320-5-0x0000000000000000-mapping.dmp
      Download
    • memory/7796-3-0x0000000000000000-mapping.dmp
      Download