b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
Size

12KB
MD5

3a7bec068bd5ddc12b3266df7ae68d04
SHA1

6f66bf634751ca44f2e1959c89b253266c1bd8f9
SHA256

b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84
SHA512

21ed9867ac77bebaf4d0888c2641d72babdd6101985ffd38b1928be42ba0d4e7dad39794b096be1da20fe260a3cd6e864c72ece925dc83761087bc432158564e
SSDEEP

192:7RksiESTYWtTIwpuHR0MgvVc/iF/JA73fMORINPk6WvW1EDp2B/0V/9SNs/:isiESTBEwAR0MgtiwJ+PMHPk6WvW1EDt

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1736	Run39.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Run39.exe = "C:\\Windows\\system\\Run39.exe"	Run39.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\N0TEPAD.EXE	Run39.exe
File opened for modification	C:\Windows\SysWOW64\N0TEPAD.EXE	Run39.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\afa45aca-e500-4d71-a550-a66b6c74a029.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221210063558.pma	setup.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system\Run39.exe	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
File opened for modification	C:\Windows\system\Run39.exe	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
File created	C:\Windows\system\N0TEPAD.EXE	Run39.exe
File opened for modification	C:\Windows\system\N0TEPAD.EXE	Run39.exe
File created	C:\Windows\N0TEPAD.EXE	Run39.exe
File opened for modification	C:\Windows\N0TEPAD.EXE	Run39.exe
File opened for modification	C:\Windows\system\windll.dll	Run39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank"	Run39.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "N0TEPAD.EXE %1"	Run39.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2036	msedge.exe
2036	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	Run39.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
1736	Run39.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 2036	3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe	80
PID 3836 wrote to memory of 2036	3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe	80
PID 2036 wrote to memory of 1120	2036	msedge.exe	81
PID 2036 wrote to memory of 1120	2036	msedge.exe	81
PID 3836 wrote to memory of 1736	3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe	82
PID 3836 wrote to memory of 1736	3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe	82
PID 3836 wrote to memory of 1736	3836	b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe	82
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 3464	2036	msedge.exe	86
PID 2036 wrote to memory of 2636	2036	msedge.exe	87
PID 2036 wrote to memory of 2636	2036	msedge.exe	87
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89
PID 2036 wrote to memory of 3036	2036	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe
"C:\Users\Admin\AppData\Local\Temp\b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.18hi.net/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff8162446f8,0x7ff816244708,0x7ff816244718
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:8
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff73ad55460,0x7ff73ad55470,0x7ff73ad55480
      4⤵
      PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,8513736754257434878,14577447010103482104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:4268
- C:\Windows\system\Run39.exe
  "C:\Windows\system\Run39.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Run39.exe

Filesize
12KB

MD5
3a7bec068bd5ddc12b3266df7ae68d04

SHA1
6f66bf634751ca44f2e1959c89b253266c1bd8f9

SHA256
b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84

SHA512
21ed9867ac77bebaf4d0888c2641d72babdd6101985ffd38b1928be42ba0d4e7dad39794b096be1da20fe260a3cd6e864c72ece925dc83761087bc432158564e

Download Submit
C:\Windows\system\Run39.exe

Filesize
12KB

MD5
3a7bec068bd5ddc12b3266df7ae68d04

SHA1
6f66bf634751ca44f2e1959c89b253266c1bd8f9

SHA256
b8ad3a57d61ecb4b19607bc407b89144217d572b7fcb6997bbe4a899fb2a3c84

SHA512
21ed9867ac77bebaf4d0888c2641d72babdd6101985ffd38b1928be42ba0d4e7dad39794b096be1da20fe260a3cd6e864c72ece925dc83761087bc432158564e

Download Submit
memory/1736-143-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3836-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3836-141-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download