06a1095054a1ab69bc13662b60f21a725d50286fabecd045f6df744b213a4c4e

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Size

255KB
MD5

5f88e9dea36c0a29fcee359567ca68a3
SHA1

68f8fd802e635799166f1098ba17bd54235a7b0c
SHA256

06a1095054a1ab69bc13662b60f21a725d50286fabecd045f6df744b213a4c4e
SHA512

938b78aa7e453cd2c9352a45bf757825d00797589a568af2b415dbe9899d45cf4ab8ba535783a3d9398868fc6cbedbe11196da5d7d81c883e28bd221d181f452
SSDEEP

6144:o64tXafE0Mqpm+SKAqpByuqPoEbLvRdvf1:o68r0Mqpm+SCB3KbLzN

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
2976	regsvr32.exe
3020	regsvr32.exe
2760	explorer.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32	regsvr32.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001b00000001561d-3.dat	upx
behavioral1/files/0x001b00000001561d-4.dat	upx
behavioral1/memory/3020-7-0x000007FEF71F0000-0x000007FEF725D000-memory.dmp	upx
behavioral1/files/0x001b00000001561d-6.dat	upx
behavioral1/files/0x001b00000001561d-8.dat	upx
behavioral1/memory/2760-10-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-12-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-14-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-15-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-19-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-25-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-26-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx
behavioral1/memory/2760-31-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\ = "MediaViewerPluginLib"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ = "IMediaViewerIdentifier"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\ = "MediaViewer6172 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ = "IMediaViewerIdentifier"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
2760	explorer.exe
2760	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2436 wrote to memory of 2976	2436	2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe	28
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29
PID 2976 wrote to memory of 3020	2976	regsvr32.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:3020

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat

Filesize
95KB

MD5
bf52cd701b14f23225a64bd76dcf8cdf

SHA1
0fe0076f87777d7752f60e8a6f76e9ec5e1aa82a

SHA256
eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d

SHA512
6b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2

Download Submit
C:\Users\Admin\AppData\Roaming\SogouPinyin.local

Filesize
77B

MD5
fcc21d925935117d130df4d9a26a5f56

SHA1
54541069b09a46091885de0259034d05ac978417

SHA256
ebfead48ce9da04104743c987943d6fc31703ea6917dbec7dfc3b3856950b119

SHA512
b817d976696898ef45d5fa70feeec69cd18cbac5db05bc380bdfcb5812862a0887cd52dcb5740db61482d68adb47899f40a1d4bd7006e293e29d545ff14ed78f

Download Submit
\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat

Filesize
95KB

MD5
bf52cd701b14f23225a64bd76dcf8cdf

SHA1
0fe0076f87777d7752f60e8a6f76e9ec5e1aa82a

SHA256
eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d

SHA512
6b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2

Download Submit
\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat

Filesize
95KB

MD5
bf52cd701b14f23225a64bd76dcf8cdf

SHA1
0fe0076f87777d7752f60e8a6f76e9ec5e1aa82a

SHA256
eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d

SHA512
6b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2

Download Submit
\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat

Filesize
95KB

MD5
bf52cd701b14f23225a64bd76dcf8cdf

SHA1
0fe0076f87777d7752f60e8a6f76e9ec5e1aa82a

SHA256
eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d

SHA512
6b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2

Download Submit
memory/2760-13-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download
memory/2760-9-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/2760-10-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-12-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-14-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-15-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-16-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download
memory/2760-19-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-25-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-26-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2760-31-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp

Filesize
436KB

Download
memory/2976-5-0x0000000000280000-0x00000000002ED000-memory.dmp

Filesize
436KB

Download
memory/3020-7-0x000007FEF71F0000-0x000007FEF725D000-memory.dmp

Filesize
436KB

Download