b9b692fd597fd59ddc516e43ab66367263c7ebd7f85c6666d5751729711cca59

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

izyb - Linkvertise Downloader_RrW4-d1.exe
Size

2.6MB
MD5

ebc320a21c5ed81dd2dbf13d4c71addc
SHA1

ec09eeb7873520c0f4f1f2ca9a196ef6df4fa36f
SHA256

b9b692fd597fd59ddc516e43ab66367263c7ebd7f85c6666d5751729711cca59
SHA512

dbfefd704ffe78863e5f12ad73360f578361234a3a1914d6021a0d000ab994e4667255600f9b4052e86a0842d755f7b3ca44fd098bedb644327edf2149989482
SSDEEP

49152:4qe3f6ahzD7+H98AHaCfu64HCL+WuTmuKwET:NSiAD7E9vButHCK5NKXT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp

Loads dropped DLL 3 IoCs

pid	Process
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230106223516.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5f75ed13-aa60-4758-ae01-2c03a9edf417.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	izyb - Linkvertise Downloader_RrW4-d1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	izyb - Linkvertise Downloader_RrW4-d1.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
1060	msedge.exe
1060	msedge.exe
1964	identity_helper.exe
1964	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	izyb - Linkvertise Downloader_RrW4-d1.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4884	3568	izyb - Linkvertise Downloader_RrW4-d1.exe	80
PID 3568 wrote to memory of 4884	3568	izyb - Linkvertise Downloader_RrW4-d1.exe	80
PID 3568 wrote to memory of 4884	3568	izyb - Linkvertise Downloader_RrW4-d1.exe	80
PID 4884 wrote to memory of 1060	4884	izyb - Linkvertise Downloader_RrW4-d1.tmp	83
PID 4884 wrote to memory of 1060	4884	izyb - Linkvertise Downloader_RrW4-d1.tmp	83
PID 1060 wrote to memory of 4956	1060	msedge.exe	84
PID 1060 wrote to memory of 4956	1060	msedge.exe	84
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 316	1060	msedge.exe	87
PID 1060 wrote to memory of 3400	1060	msedge.exe	88
PID 1060 wrote to memory of 3400	1060	msedge.exe	88
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89
PID 1060 wrote to memory of 5044	1060	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\izyb - Linkvertise Downloader_RrW4-d1.exe
"C:\Users\Admin\AppData\Local\Temp\izyb - Linkvertise Downloader_RrW4-d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\is-U376U.tmp\izyb - Linkvertise Downloader_RrW4-d1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-U376U.tmp\izyb - Linkvertise Downloader_RrW4-d1.tmp" /SL5="$8004A,1785071,899584,C:\Users\Admin\AppData\Local\Temp\izyb - Linkvertise Downloader_RrW4-d1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://justpaste.it/a6oas
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffd3ba546f8,0x7ffd3ba54708,0x7ffd3ba54718
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5864 /prefetch:8
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff673d25460,0x7ff673d25470,0x7ff673d25480
        5⤵
        
        PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:8
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1752 /prefetch:8
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,9142811828158228062,16117672850118461556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 /prefetch:8
      4⤵
      PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-I2TFJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I2TFJ.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I2TFJ.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
e1f18a22199c6f6aa5d87b24e5b39ef1

SHA1
0dcd8f90b575f6f1d10d6789fe769fa26daafd0e

SHA256
62c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d

SHA512
5a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U376U.tmp\izyb - Linkvertise Downloader_RrW4-d1.tmp

Filesize
3.0MB

MD5
74fad5c6cd2d3af1fa257b5e9531993a

SHA1
ab701031918456195cf9a12a8b33f9417a9f6496

SHA256
8dc40627fa4c09f7fd6df78e3ad03d7db3767010e15418dba24e63754dcbc59b

SHA512
05b107537675cfa43f3cc744c3de9164069816401af9fdb7a82dcb1a021985b97f2ecc56e3ea17151a0dee97b0af175f0883b8fb4cf5c5f7d72a5479c5557edb

Download Submit
memory/3568-144-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3568-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3568-134-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3568-132-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/4884-141-0x00000000067C0000-0x00000000067CF000-memory.dmp

Filesize
60KB

Download