e49a49b521e91f3c9c3ac5b429ed460138875258b65dcee774fd9cf40830c15b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

787fc46c2c0644326c6ddc2f1f2448f8.exe
Size

2.5MB
MD5

787fc46c2c0644326c6ddc2f1f2448f8
SHA1

09b93617b0c6f278d13561278e7caf34b5317f48
SHA256

e49a49b521e91f3c9c3ac5b429ed460138875258b65dcee774fd9cf40830c15b
SHA512

8d724abe0ec8dac83d14878ab9b546f8d0190ec905895377d37c7878e93b5c0807581b62ef705999bfe7b06f69e07d167db77703f521ba74792d020b0a434483
SSDEEP

49152:k0INtkVF+cBjjgIMkQi/yQKOZpViMqnVA7N2Ql5msqxM2TVA:RIN40cBjjixi6Q/pR5dgM+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3720-0-0x0000000000400000-0x00000000006BD000-memory.dmp	upx
behavioral2/memory/3720-84-0x0000000000400000-0x00000000006BD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
2604	msedge.exe
2604	msedge.exe
2920	identity_helper.exe
2920	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3720	787fc46c2c0644326c6ddc2f1f2448f8.exe
3720	787fc46c2c0644326c6ddc2f1f2448f8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 2604	3720	787fc46c2c0644326c6ddc2f1f2448f8.exe	92
PID 3720 wrote to memory of 2604	3720	787fc46c2c0644326c6ddc2f1f2448f8.exe	92
PID 2604 wrote to memory of 1008	2604	msedge.exe	93
PID 2604 wrote to memory of 1008	2604	msedge.exe	93
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4864	2604	msedge.exe	95
PID 2604 wrote to memory of 4864	2604	msedge.exe	95
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96
PID 2604 wrote to memory of 4980	2604	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\787fc46c2c0644326c6ddc2f1f2448f8.exe
"C:\Users\Admin\AppData\Local\Temp\787fc46c2c0644326c6ddc2f1f2448f8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.59tou.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93e5746f8,0x7ff93e574708,0x7ff93e574718
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13396916712149958059,12150781568657381254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e3208592c5c0328e14977a1a14654803

SHA1
97ae8bf667bb632b5c587654419ed87c6e015923

SHA256
daab3b85c0dcea1aa7041aff111b926f29fd32be369c60cca66c3ca4552ea0c1

SHA512
ccfdf904f76ccdf30abfb0329639a3e1e4a3d108b30dcfc8ee98ce6b2a7ee88b7a3b5d53dbf03c78f96178e729779701c4e6688de6f841a5fb4406f3b80dc870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0f7b1b46f9e863b01b094375e7ef716

SHA1
8d5d744d2f9f5bea12c6b9830c13cff96d32c9da

SHA256
d3139f2292d84a57febf24b75f05785847e625c4634b007e496a1e2fb5af8fd6

SHA512
03d1c3b598a61faa726193599ad7e6d5363e3bf7b74df13ece8ff8244a303381ac0ba5b2faf4d3c3002f60416a6c3b3312c62631017b4999b2569b56cd479595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b161b755b833149b49f145cc2e9592ea

SHA1
d5996e83092ec68facba88566e8120ddd7a630c1

SHA256
fa5a5516f42fb2f36a485688ab9fbe29e4a026f1bd71add048e7e331d89f7ec5

SHA512
dd3b07216b75d36f3fbb3973ba48368f681663e76df4c748ce636a18a4c3210f0a84e0376949ae380818bb16b69f26330aced693f6497dcddad37c6333c5719f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1537f27ed6d2190de47ee7aabf0e4745

SHA1
f9458fdc304fadc9e439e4b4fef7c8db132bb9ce

SHA256
6d68a5aef4fb7a7899ad9c1c101192665e4a415737ad368043582379a4379a47

SHA512
08f335cb5a55968e7cc61aef116d8180ef3cef01d9a5356d7122d28163b3f16a30813f08167201a0e6094ed8d57f15ea436ccf0deb2acf384f76f2bc3dc5542b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ff8998018a9aee27a0b411c05a27655

SHA1
93b9cb3fd6a4a3433cd6e4155de1fe14d8d88d6b

SHA256
8ce4247533f528b7d1cc8358fc1f7bc25d36663a7b3f6b04b9087511d5a1e3bb

SHA512
05a18b888d0fde0ea31b491b45de26c20cb3633ab5d33f986cb18c338fba08cfe1f29e6b549c377bef916045cd8f020228a68895d5509b61a3cd81c7f6f0911d

Download Submit
memory/3720-0-0x0000000000400000-0x00000000006BD000-memory.dmp

Filesize
2.7MB

Download
memory/3720-84-0x0000000000400000-0x00000000006BD000-memory.dmp

Filesize
2.7MB

Download