warzonerat | 0b731f9563887bc9ba8a88f6b7bf8b6aea379e24d521ff5572bc9c287ab68d00

Analysis

max time kernel
87s
max time network
142s
platform
windows10_x64
resource
win10v20210408
submitted
15-07-2021 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL_Jul 2021 at 1.7553BZ290_PDF.exe
Size

1012KB
MD5

c2df38da028057224b6cdf75dc908656
SHA1

d8496905a1687bf08dc616384fd99f816e999268
SHA256

0b731f9563887bc9ba8a88f6b7bf8b6aea379e24d521ff5572bc9c287ab68d00
SHA512

9c42edcf1ffc5e5f4eca45cca8d78ed6a2422417e69479d5429a727864bd015328a98c36c83807658eb4dce45188af145705fa546e4d1de745428f6b01dfd423

Score

10^/10

warzonerat infostealer rat spyware stealer

Malware Config

Extracted

Family

warzonerat

103.133.109.176:7600

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Loads dropped DLL 6 IoCs

Processes:

DHL_Jul 2021 at 1.7553BZ290_PDF.exe

pid	process
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_Jul 2021 at 1.7553BZ290_PDF.exe

description pid process target process

PID 652 set thread context of 4004 652 DHL_Jul 2021 at 1.7553BZ290_PDF.exe DHL_Jul 2021 at 1.7553BZ290_PDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3980 schtasks.exe

description	pid	process	target process
PID 652 set thread context of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe

pid	process
3980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

DHL_Jul 2021 at 1.7553BZ290_PDF.exepowershell.exepowershell.exepowershell.exe

pid	process
652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
3868	powershell.exe
1412	powershell.exe
2272	powershell.exe
1412	powershell.exe
2272	powershell.exe
3868	powershell.exe
3868	powershell.exe
2272	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exeDHL_Jul 2021 at 1.7553BZ290_PDF.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
Token: SeDebugPrivilege	2272	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DHL_Jul 2021 at 1.7553BZ290_PDF.exe

pid process

4004 DHL_Jul 2021 at 1.7553BZ290_PDF.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

DHL_Jul 2021 at 1.7553BZ290_PDF.exeDHL_Jul 2021 at 1.7553BZ290_PDF.exe

description	pid	process	target process
PID 652 wrote to memory of 1412	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 1412	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 1412	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 3868	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 3868	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 3868	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 3980	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	schtasks.exe
PID 652 wrote to memory of 3980	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	schtasks.exe
PID 652 wrote to memory of 3980	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	schtasks.exe
PID 652 wrote to memory of 2272	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 2272	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 2272	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	powershell.exe
PID 652 wrote to memory of 2244	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 2244	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 2244	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4000	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4000	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4000	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 652 wrote to memory of 4004	652	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	DHL_Jul 2021 at 1.7553BZ290_PDF.exe
PID 4004 wrote to memory of 1960	4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	cmd.exe
PID 4004 wrote to memory of 1960	4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	cmd.exe
PID 4004 wrote to memory of 1960	4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	cmd.exe
PID 4004 wrote to memory of 1960	4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	cmd.exe
PID 4004 wrote to memory of 1960	4004	DHL_Jul 2021 at 1.7553BZ290_PDF.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jbgTwfXHl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jbgTwfXHl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B76.tmp"
2⤵
- Creates scheduled task(s)
PID:3980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jbgTwfXHl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe"
2⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe"
2⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Jul 2021 at 1.7553BZ290_PDF.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
7247129cd0644457905b7d6bf17fd078

SHA1
dbf9139b5a1b72141f170d2eae911bbbe7e128c8

SHA256
dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4

SHA512
9b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
7247129cd0644457905b7d6bf17fd078

SHA1
dbf9139b5a1b72141f170d2eae911bbbe7e128c8

SHA256
dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4

SHA512
9b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
653acf6dd1bb2e39ca5685a90483aa47

SHA1
f4335902c6f92bd034f0776d1b8330375b9f13af

SHA256
c82e2c74bba5a10375f67a0e50a914e9f6f8c161b136305bef7de6b0d2969971

SHA512
e7fbe3ce29512e82e086ecf939022a1a2e780331c12e563c63bfcba6d8c68e39173d03b526ad830461785d813e5f0645d14a184adac1449df39a85eb55faa010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d53c1b6800ec3232c22b5b7fb749238a

SHA1
29574bfb32da3d8b41238b4563f1c09458a1ea87

SHA256
6b32b7b1a859968f944e7652a8fa31fa0e89afe280e2b4b41ab2878e6ec0b8b7

SHA512
b75e1ad29499d71a5114e43f0f9a65b90ee2c835c6cf428dbc58c236e2353b8ab9151209dd214eacc118b8f1945e6de405045dced06f0354c0342e569e43a061

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B76.tmp
MD5
085d051e3ca8e2d2e6fd3abf51a6f90c

SHA1
ebe4cf1f2b17096c2bde9b0bcedc2a1bcd00d36a

SHA256
fc9ce48984d35fa3246aec0bbb3276043422dea2b56c214497a603ae65d4b2d9

SHA512
faa401c9b391cb34bfd6920b1f4acc765ba8c44d37103862691f12826554934b1bb0e5453e8ad8e6c618569cb8e48ac3d50774326dbcc674bd1692fc84c03983

Download Submit
\Users\Admin\AppData\Local\Temp\freebl3.dll
MD5
ef12ab9d0b231b8f898067b2114b1bc0

SHA1
6d90f27b2105945f9bb77039e8b892070a5f9442

SHA256
2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

SHA512
2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

Download Submit
\Users\Admin\AppData\Local\Temp\mozglue.dll
MD5
75f8cc548cabf0cc800c25047e4d3124

SHA1
602676768f9faecd35b48c38a0632781dfbde10c

SHA256
fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

SHA512
ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

Download Submit
\Users\Admin\AppData\Local\Temp\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\Users\Admin\AppData\Local\Temp\nss3.dll
MD5
d7858e8449004e21b01d468e9fd04b82

SHA1
9524352071ede21c167e7e4f106e9526dc23ef4e

SHA256
78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

SHA512
1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

Download Submit
\Users\Admin\AppData\Local\Temp\softokn3.dll
MD5
471c983513694ac3002590345f2be0da

SHA1
6612b9af4ff6830fa9b7d4193078434ef72f775b

SHA256
bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

SHA512
a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

Download Submit
\Users\Admin\AppData\Local\Temp\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
memory/652-123-0x0000000004E40000-0x0000000004E51000-memory.dmp

Filesize
68KB

Download
memory/652-118-0x000000000AA20000-0x000000000AA21000-memory.dmp

Filesize
4KB

Download
memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/652-116-0x00000000073A0000-0x0000000007477000-memory.dmp

Filesize
860KB

Download
memory/652-125-0x0000000007360000-0x000000000738B000-memory.dmp

Filesize
172KB

Download
memory/652-117-0x000000000A480000-0x000000000A481000-memory.dmp

Filesize
4KB

Download
memory/652-119-0x000000000A5C0000-0x000000000A5C1000-memory.dmp

Filesize
4KB

Download
memory/652-124-0x000000000A520000-0x000000000A58F000-memory.dmp

Filesize
444KB

Download
memory/652-120-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/652-122-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/652-121-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/1412-195-0x0000000009160000-0x0000000009193000-memory.dmp

Filesize
204KB

Download
memory/1412-149-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/1412-151-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Filesize
4KB

Download
memory/1412-154-0x00000000079D0000-0x00000000079D1000-memory.dmp

Filesize
4KB

Download
memory/1412-138-0x0000000006CF2000-0x0000000006CF3000-memory.dmp

Filesize
4KB

Download
memory/1412-129-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

Filesize
4KB

Download
memory/1412-135-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1412-132-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/1412-126-0x0000000000000000-mapping.dmp

Download
memory/1412-242-0x0000000006CF3000-0x0000000006CF4000-memory.dmp

Filesize
4KB

Download
memory/1412-211-0x000000007EEF0000-0x000000007EEF1000-memory.dmp

Filesize
4KB

Download
memory/1960-173-0x0000000000000000-mapping.dmp

Download
memory/2272-243-0x0000000007073000-0x0000000007074000-memory.dmp

Filesize
4KB

Download
memory/2272-142-0x0000000000000000-mapping.dmp

Download
memory/2272-207-0x000000007F790000-0x000000007F791000-memory.dmp

Filesize
4KB

Download
memory/2272-161-0x0000000007070000-0x0000000007071000-memory.dmp

Filesize
4KB

Download
memory/2272-163-0x0000000007072000-0x0000000007073000-memory.dmp

Filesize
4KB

Download
memory/2272-159-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/3868-170-0x0000000008910000-0x0000000008911000-memory.dmp

Filesize
4KB

Download
memory/3868-166-0x0000000008600000-0x0000000008601000-memory.dmp

Filesize
4KB

Download
memory/3868-164-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/3868-241-0x0000000007263000-0x0000000007264000-memory.dmp

Filesize
4KB

Download
memory/3868-130-0x0000000000000000-mapping.dmp

Download
memory/3868-219-0x0000000009670000-0x0000000009671000-memory.dmp

Filesize
4KB

Download
memory/3868-214-0x000000007EA60000-0x000000007EA61000-memory.dmp

Filesize
4KB

Download
memory/3868-137-0x0000000007260000-0x0000000007261000-memory.dmp

Filesize
4KB

Download
memory/3868-139-0x0000000007262000-0x0000000007263000-memory.dmp

Filesize
4KB

Download
memory/3980-131-0x0000000000000000-mapping.dmp

Download
memory/4004-348-0x00000000047F0000-0x0000000004874000-memory.dmp

Filesize
528KB

Download
memory/4004-144-0x0000000000405E28-mapping.dmp

Download
memory/4004-143-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4004-158-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4004-237-0x0000000004350000-0x000000000448C000-memory.dmp

Filesize
1.2MB

Download