a934050468eb7dda4a6e5371dc5efd5fa9c6c683dd4c93d063bafbebdb7bf7c6

Resubmissions

04/11/2024, 15:26

241104-st7zrssenl8

04/11/2024, 15:25

241104-stsj3s1new7

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04/11/2024, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nitroTypeInstaller.exe
Size 25.3MB
Sample241104-st7zrssenl
SHA256 a934050468eb7dda4a6e5371dc5efd5fa9c6c683dd4c93d063bafbebdb7bf7c6
MD5 c82e6b27395136c0f052cf506de956a0
SHA1 6aee205ccbfd007135bc9b61238769c1f235d7c4
SHA512 649ae75e50f953eb35619a25135f71bb8175f1f3f4eccce4c52d355d920017531940f0c1e050c2adfbe74c363b286fa0c9d8a1ce292e1c791d29d8fb156b198a
SSDEEP 786432:L/wiglxs4yIquTeKTJYpwGiQImZ/pFTwVoTGLrb4z:jwfxs4yIqeeHpw7QImt8VoT9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2024	nitroTypeInstaller.tmp
5040	NitroType3.exe

Loads dropped DLL 1 IoCs

pid	Process
5040	NitroType3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitroTypeInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitroTypeInstaller.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4252	msedgewebview2.exe
2944	msedgewebview2.exe
712	msedgewebview2.exe
4848	msedgewebview2.exe
1492	msedgewebview2.exe
2024	msedgewebview2.exe
1956	msedgewebview2.exe
3524	msedgewebview2.exe
2204	msedgewebview2.exe
3036	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	nitroTypeInstaller.tmp
2024	nitroTypeInstaller.tmp
4544	msedgewebview2.exe
4544	msedgewebview2.exe
1492	msedgewebview2.exe
1492	msedgewebview2.exe
4848	msedgewebview2.exe
4848	msedgewebview2.exe
4848	msedgewebview2.exe
4848	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1956	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2024	nitroTypeInstaller.tmp
1956	msedgewebview2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2024	1452	nitroTypeInstaller.exe	80
PID 1452 wrote to memory of 2024	1452	nitroTypeInstaller.exe	80
PID 1452 wrote to memory of 2024	1452	nitroTypeInstaller.exe	80
PID 2024 wrote to memory of 5040	2024	nitroTypeInstaller.tmp	82
PID 2024 wrote to memory of 5040	2024	nitroTypeInstaller.tmp	82
PID 5040 wrote to memory of 1956	5040	NitroType3.exe	83
PID 5040 wrote to memory of 1956	5040	NitroType3.exe	83
PID 1956 wrote to memory of 3524	1956	msedgewebview2.exe	84
PID 1956 wrote to memory of 3524	1956	msedgewebview2.exe	84
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2204	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 4544	1956	msedgewebview2.exe	86
PID 1956 wrote to memory of 4544	1956	msedgewebview2.exe	86
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 3036	1956	msedgewebview2.exe	87

C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\is-GM83M.tmp\nitroTypeInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GM83M.tmp\nitroTypeInstaller.tmp" /SL5="$50106,25703837,831488,C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe
    "C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=5040.4664.14878430363550826538
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x1bc,0x7ffd59043cb8,0x7ffd59043cc8,0x7ffd59043cd8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2472 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4460 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1700 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4688 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2024
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3528 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1900,18168336154795168285,10425061287852453659,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+80b7fddd7af9ef7126adb844ebdb1eaa2b3c81b0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4112 /prefetch:2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\Microsoft.Web.WebView2.Core.dll
Size 557KB
SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
MD5 b037ca44fd19b8eedb6d5b9de3e48469
SHA1 1f328389c62cf673b3de97e1869c139d2543494e
SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
MD5 8153423918c8cbf54b44acec01f1d6c2
SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NitroType3.deps.json

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.deps.json
Size 1KB
SHA256 823f4a5977439eb3ebd59fc91363bf782ee64fbfc98851cc5de319696b382901
MD5 6b7135e884cd85a9c72d70685f76c169
SHA1 8eea921dd4403a6ca4d2dffcc2a7c53428bf3372
SHA512 f033070239af98206652ec2928322f9e14acbef6170048a022cf616307de11435ed1a545d778cdbe93d2d4d092b6670df55e44249904021cd33a7d21b98c994b
MD5 SHA1 SHA512

Submit Download

NitroType3.dll

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.dll
Size 51KB
SHA256 a3f3357b265839916e77abcb98ea9353d7b2c57b983dc3b093723ce6430f0e52
MD5 06a16b989d28478dbdbffef6f919126a
SHA1 e08cdd7d420c2531783340608084d3868d1bc8a8
SHA512 55094c382cc0a2662c6a4120e848f17fe13dffc5e99322ff94665bf6bfd238523c45a80383f941acf964b3e4cc9413531e03ff02dd853fe7fab47fd5a2376480
SSDEEP 1536:RYoM0DDnfc70IQXNtnSwjkeiDRph6oLiLxqZD+bsy5zfr:RtnBIQXNtSwjkeiDRpMoLiLx8Dwsy5jr
MD5 SHA1 SHA512 SSDEEP

Submit Download

NitroType3.dll.config

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.dll.config
Size 1KB
SHA256 73fb38fc8fcbdfd84dfb798844f8df75a7f2a27ae1da8b9bd0bc002076a9b081
MD5 25fe4c0dda7cb683ff9c99f8459c79cb
SHA1 08c66413bb977d261018e04895b875e6db3617f1
SHA512 28ac6ea86d8e8298701b934bd2e99456f3a416c7ab8c8b48b98bb1ffb60ec8190f818ad9b6ea027bb2d020e728147d004ce14038abe7ad61473b002569f115f7
MD5 SHA1 SHA512

Submit Download

NitroType3.exe

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe
Size 139KB
SHA256 9260a1eb99eeece2e96ddc58affe67bccebfc0becb5ab3388e031774d8030011
MD5 256205ba52daf77098af7b6ef6955a9b
SHA1 853ebe2012fcfea6d2d7f2fb3afab559fb614fb5
SHA512 83697a0d0f5025a8a0b5cb086d1842161ab4eb204d96d19b44c52268674aad4f0f3a751a9bc41f4b60f9be2fd218bc3c7c9b3339cf699009235af8a2d1453568
SSDEEP 3072:niS4omp03WQthI/9S3BZi08iRQ1G78IVn2sbS7cJT8ltr:niS4ompB9S3BZi0a1G78IVAcVct
MD5 SHA1 SHA512 SSDEEP

Submit Download

876075f1-458d-4793-8507-c1f2c77a0c6e.tmp

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\876075f1-458d-4793-8507-c1f2c77a0c6e.tmp
Size 8KB
SHA256 e0b112111f701171b01b0fb01850efd989f40b3cbac1c2250a31a0dbcdd5c19d
MD5 79c0b6cf3b51132209c34da1660664ac
SHA1 c6f858adc5369210aa1b3348e4ccaf6b9d98a9d9
SHA512 f31e2f626c8dc7728374cd388118aa17845183b3405f2f4939c32c10133dc5ebf331901bc1b9b910e19e14eff2d9adecf1f1febf64c1cce5c4d21d46b1a36617
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAS6Nt9eMRUYj9yVsfbIoBn4:e9iIxuERzA83h09RZxAS05PsVq1n4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 152B
SHA256 8da3f4ac984c5fdac50d53ce532672570666a3bf4fedc0a38f780702b3435296
MD5 68b391d4f7c597d5e461146f6b48d52c
SHA1 87a4500d93e3f04039b3f372d6a50618a0b9fc5f
SHA512 a221ce9c1dbc4112a159d4365ade807946b889d2874c8a11e4dde34d74d0c8f148458c961dd7437ff8da7d147a99db64f603d0ee8d63312017ae01c8dcd023bc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network Persistent State
Size 299B
SHA256 8d08d9d62f65797f863ba6ccc0954633c150a8c8a89ba16f962bec6bb485c1b3
MD5 cb5580bdfd34bab704f16a262bcc299c
SHA1 057b0b239b2cbef048551259c7f327c21396286a
SHA512 32371ca25cc1fc62c0ac1c625e2fd475a52a5764491637ab1c43bec5d6656764cc3f5c7ae23e2be538e27309934a61e2ce15d5a8ff9a9a1a876941616957edd3
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe590a08.TMP

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network Persistent State~RFe590a08.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences
Size 3KB
SHA256 d708c9e33e14d37e269b0bca36c7ce8aa9587d2288e6d12f2903e63fff689dee
MD5 88f13ed1972529e63ae3b3730d1f7e35
SHA1 dd77719a2e37db209ca9b92b9b1f8c3acfaffa22
SHA512 ce49d29a3e0da19ce8c17fd188c78e8dfd0f469705d211ea27ad2c0acd96144c393b13e40fc44fd9c6cbbfd47c1d39019f1441476229ab2d7fe4e17972e38682
MD5 SHA1 SHA512

Submit Download

Preferences~RFe58f6af.TMP

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences~RFe58f6af.TMP
Size 3KB
SHA256 fca8388213aa9071dcb94bc48c96822461e05c1184baf33ba73506d2490caa10
MD5 b2039441f7bd896154bdb9c0d1140830
SHA1 addbf8c1f03d0205ae244d4041763a594d1900c9
SHA512 50d8298f3443624a2df22a355d0c4d52b47454a02f1d95040872cbf53864863ac6204165b48c5097a767f610f0c19ab7b8b6d345994036452bdf4a3a1266fc14
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

NitroType3.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.runtimeconfig.json
Size 458B
SHA256 c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
MD5 07b9a30265ca4e69c7016a1b6e3ffc27
SHA1 3a4af82a2695b1423aedd8b60a5c86793c011b02
SHA512 efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
MD5 SHA1 SHA512

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\runtimes\win-x64\native\WebView2Loader.dll
Size 161KB
SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
MD5 c5f0c46e91f354c58ecec864614157d7
SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
MD5 SHA1 SHA512 SSDEEP

Submit Download

nitroTypeInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-GM83M.tmp\nitroTypeInstaller.tmp
Size 3.0MB
SHA256 40f59a9184f265f3c4d0128dd7c7e7f430ff1230fee1dfbd8f4e580d01d97ec0
MD5 bb0e0df7aa0bf5f7da26269d36954641
SHA1 0207af4a2e662c17170c6376522c640a65c78e17
SHA512 dde66eedd32e1f7557a75989c6ae6b07a17a424a3b8a6582a75c39904d861225130cbbee5f1e8bf6c820594753cd3a721ae4778f7a78a21a65f04ebd29507c0c
SSDEEP 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TY:692bz2Eb6pd7B6bAGx7s333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/712-455-0x0000024018540000-0x00000240185DE000-memory.dmp

Download

memory/1452-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1452-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/1452-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1452-154-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2024-6-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2024-10-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2024-87-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2024-153-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2024-423-0x00000184F8740000-0x00000184F87DE000-memory.dmp

Download

memory/2204-293-0x0000027C37C00000-0x0000027C37C9E000-memory.dmp

Download

memory/2204-183-0x00007FFD7BE10000-0x00007FFD7BE11000-memory.dmp

Download

memory/2944-389-0x0000024C23E00000-0x0000024C23E9E000-memory.dmp

Download

memory/3036-301-0x000001AA2AA00000-0x000001AA2AA9E000-memory.dmp

Download

memory/4252-302-0x000002030FC20000-0x000002030FCBE000-memory.dmp

Download