banload | 2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Size

3.9MB
MD5

85eed7d73c6d1234229d9d7266b08060
SHA1

9e194d96d27c4adfe67ec7eb83e1d7e60df07b26
SHA256

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8
SHA512

1b59198128bf362b26b9c09bbb3ac0dfb9346005da48c6cb29d5a8189c2caaa4a106e859236e8d0455be1bae85608f77ff408e258ee7f0dec0868a7a780fa50d
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHklZ77Szh9ownI:RF8QUitE4iLqaPWGnEvS9Ejzh9oEI

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Renames multiple (199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Drops file in Program Files directory 64 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\ClearConvertTo.xsl.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Modifies registry class 5 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "C:\\Windows\\SysWOW64\\wmcodecdspps.dll"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	pid	Process
Token: 33	2360	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Token: SeIncBasePriorityPrivilege	2360	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

C:\Users\Admin\AppData\Local\Temp\2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
"C:\Users\Admin\AppData\Local\Temp\2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
4.0MB

MD5
5b929370e84ad20c2051f479520f5956

SHA1
f883b5f55ea4692e723be5269dbf2126a0803a65

SHA256
fb0d030c4d93328e3028f11b251ac9801e77e4ba1045701a7debc8f01420384f

SHA512
c24c72adc4a15e7547e6425620379f852debdbe3bed2535a4b5cb0166f171f7fd758f9d12ea568d9d2c9675b173fe9e0f922f8d75f4ed72403d4633a79c022ba

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
4.1MB

MD5
a5da00043ab3c7d607db2d5652830e67

SHA1
53ab41a22731a0d4c6b676ad3f6c0d243eff82fd

SHA256
cb819e0d7dd30d047cb8cb9561d0ad7a02a776e8474f6f45dfa3c05597646d38

SHA512
410339ecab0732538f4e24b7f34241c9b245b106ea017360b208065f8b7d8ae9285a365f6b3f500a329f6465477a30de61921e8c564c715c45de1ad8624c2cdc

Download Submit
memory/2360-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2360-1-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2360-8-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2360-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2360-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2360-13-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2360-25-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2360-43-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2360-51-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download