Overview

overview

10

Static

static

3

tmp3iavfc45.exe

windows10-ltsc_2021-x64

10

tmp3iavfc45.exe

windows10-2004-x64

10

tmp3iavfc45.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    111s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 18:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp3iavfc45.exe
  • Size 2.9MB
  • Sample260601-xmlv6sdw5z
  • SHA256 fab31c7ce69eadb4545e26552b6bd375e2ae758cf82224ca9e6dec71a654f00f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionnetwirepersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • netwire

C2

  • s3awscloud.com:8080

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-qmIkm2

  • keylogger_dir

    C:\Users\Admin\AppData\Roaming\sLogs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    mrx325hydra11

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • Family: Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • NetWire RAT payload 2 IoCs
    rat
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 63 IoCs
  • Checks for any installed AV software in registry 1 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp3iavfc45.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp3iavfc45.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\wnupdate.exe
      "C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\wnupdate.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1652
    • C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\avira.exe
      "C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\avira.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.31535\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\.CR.2498\Avira.Spotlight.Bootstrapper.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.2498\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.2498\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira.exe
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for any installed AV software in registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Users\Admin\AppData\Local\Temp\9a485585-4f9b-4265-8fad-2476c1b12414\avira.exe
          "C:\Users\Admin\AppData\Local\Temp\9a485585-4f9b-4265-8fad-2476c1b12414\avira.exe" SelfUpdate=false AllowMultipleInstances=true
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1664
          • C:\Users\Admin\AppData\Local\Temp\.CR.11265\Avira.Spotlight.Bootstrapper.exe
            "C:\Users\Admin\AppData\Local\Temp\.CR.11265\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.11265\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira.exe SelfUpdate=false AllowMultipleInstances=true
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks for any installed AV software in registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2176
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.1491\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4364
  • C:\Users\Admin\AppData\Local\Temp\.CR.1339\Avira.Spotlight.Bootstrapper.Runner.exe
    C:\Users\Admin\AppData\Local\Temp\.CR.1339\Avira.Spotlight.Bootstrapper.Runner.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1972
  • C:\Users\Admin\AppData\Local\Temp\.CR.6567\Avira.Spotlight.Bootstrapper.Runner.exe
    C:\Users\Admin\AppData\Local\Temp\.CR.6567\Avira.Spotlight.Bootstrapper.Runner.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
        • Size 330KB
        • SHA256 89c8d3f0720de5c9d1e61e49a792a1982aa8888e7ed0c2901f9e4c6d30b9fac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
        • Size 1.5MB
        • SHA256 5d67b8ce03c074d008f9e84e1a85727234f46a55062752d77ef1057a58397401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
        • Size 166KB
        • SHA256 74875064826270d2a5ab115a1417d460777ddc3c2b1bf77a015e36991a01502c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOC.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\DRYIOC.DLL
        • Size 440KB
        • SHA256 a5d729c0ae2d247ff1d9be14d92c45e453158b79525cafaf3900b8c29f252c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOC.MEFATTRIBUTEDMODEL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\DRYIOC.MEFATTRIBUTEDMODEL.DLL
        • Size 69KB
        • SHA256 fc3285d5ab48d0651baae23f09e31034c9af5af62cda7ee97df28aa0cca99dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOCATTRIBUTES.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\DRYIOCATTRIBUTES.DLL
        • Size 32KB
        • SHA256 6d226e2a5a605c73664e12324976d9a91c2372fa83563ec414ce953526f69f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PRODUCTLABEL.COMMON.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\PRODUCTLABEL.COMMON.DLL
        • Size 179KB
        • SHA256 4856ad81d1bb3021d55f756bdf14c537ff5f37d23a2a2e571c9e04992bc64ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PRODUCTLABEL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.11265\PRODUCTLABEL.DLL
        • Size 248KB
        • SHA256 3bcd5cdd2988000a07e10da6b77a2bbe254091bce76589d07699b5d8adf0db90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Avira.Spotlight.Bootstrapper.Runner.exe
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.1339\Avira.Spotlight.Bootstrapper.Runner.exe
        • Size 178KB
        • SHA256 cc1e291518298a820e7ddcdc6fdf3a427331da8e53c1f1183a99f6e27df710b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Avira.Spotlight.Bootstrapper.Runner.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.1339\Avira.Spotlight.Bootstrapper.Runner.exe.config
        • Size 412B
        • SHA256 927c1958bce5038e86d221044ba4a3423ac8c162c1d982301f000388b46bc829
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Avira_Security_Installation.xml
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.1491\Avira_Security_Installation.xml
        • Size 1KB
        • SHA256 7f4bf13be31400920191f49ba393c3c1911826906a760005006f929756204430
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AVIRA.COMMON.GUARDS.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.COMMON.GUARDS.DLL
        • Size 15KB
        • SHA256 dbdba7694db98e4b101fd025e595fa83aa305dd983fe0619a3b65142c7c0bc43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.COMMON.MIXPANEL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.COMMON.MIXPANEL.DLL
        • Size 59KB
        • SHA256 84eb0629c60aaae0e00aff790bd2718fdd6925a57f1d523255b10cbb4e77ee7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.FILEDOWNLOADER.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.FILEDOWNLOADER.DLL
        • Size 45KB
        • SHA256 01d250970969a255973457239188bc303f62f70a04b41e67d696536e20a318c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
        • Size 315KB
        • SHA256 986bd6661ae7534935ea29a558a86be6b49db3d2d93d7eac94a9937ccf6a56f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
        • Size 324KB
        • SHA256 c49d1d61f2ca5780d6b8f8a97e39fec79fea5bf9cdbb5a61bc5fd8ea9dadf227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
        • Size 1.5MB
        • SHA256 5f76b0ec792a4ed35442a53e480aa4215980bdba49dbd4f046479c9972a94f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
        • Size 163KB
        • SHA256 085cfa1ffc6ad06bcb165996f1b91a15d732be30650ac5eb964e14f799e63eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
        • Size 205KB
        • SHA256 2ef52b26e5bcfedbd9f17c0fa180ded7354d6234e3db9d539243d1ca37a4ffd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOC.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\DRYIOC.DLL
        • Size 440KB
        • SHA256 1daa41613fdbe260dbe94380a640413c1b890d26131b76c959ac60863a97f5ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOC.MEFATTRIBUTEDMODEL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\DRYIOC.MEFATTRIBUTEDMODEL.DLL
        • Size 70KB
        • SHA256 d33f06a41b85490761c8ecc20d45720cf11fa366ea8484e189cd028c3c1b30fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRYIOCATTRIBUTES.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\DRYIOCATTRIBUTES.DLL
        • Size 30KB
        • SHA256 7e8727fbc8aebd0327e990cbc134c056e7797336d194c2babef68b4325ef99b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\EN-US\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
        • Size 21KB
        • SHA256 d3aa543665378bea54965cf4d89adfea09e55bf32d5e0f157c89f584e5f45ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROSOFT.WINDOWS.SHELL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\MICROSOFT.WINDOWS.SHELL.DLL
        • Size 162KB
        • SHA256 cc7464fd84d98a8ed71bedcd826916c3e545c9b5fbe0c5018b3cc1c81f61e9f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PRODUCTLABEL.COMMON.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\PRODUCTLABEL.COMMON.DLL
        • Size 179KB
        • SHA256 b3ebab73a19586aec65215df77704e38c52d90dc6f2e81278e93909c8a59d7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PRODUCTLABEL.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.2498\PRODUCTLABEL.DLL
        • Size 665KB
        • SHA256 69ad335f02070f9cf0f79ae2a02ee26504817172b97af7ae9d597e1e676d664b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Avira_Security_Installation.xml
        • Path C:\Users\Admin\AppData\Local\Temp\.CR.31535\Avira_Security_Installation.xml
        • Size 1KB
        • SHA256 78c8d15cf7b4e769ba66a3d0298181d040341cdb6befcd4d9165046f16c44c95
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        avira.exe
        • Path C:\Users\Admin\AppData\Local\Temp\9a485585-4f9b-4265-8fad-2476c1b12414\avira.exe
        • Size 5.3MB
        • SHA256 76e8e8a3fc792aecc5025cc56018116205f1d7d0dcd81b8a808ac4748932ce2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        artists.dll
        • Path C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\artists.dll
        • Size 229KB
        • SHA256 15e616ffc22a9cbdb55807841994ade75028f001e86c39f75b5e2fa8750e05a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avira.exe
        • Path C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\avira.exe
        • Size 5.7MB
        • SHA256 c2257795c9dd584302a8e5fe5e5753fed1a678dddde1c8b5261cc86a2eade310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qasgh.enc
        • Path C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\qasgh.enc
        • Size 160KB
        • SHA256 d6a6b99ec598d04f5e70aad4f31cce80f6ebea4e2877fe4a84c4f382a4f135a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wnupdate.exe
        • Path C:\Users\Admin\AppData\Roaming\1qO3qlwIfR\wnupdate.exe
        • Size 249KB
        • SHA256 8a1a3b805098277b1a6869c7553627e94001e238aac45f9c0e0e5e3ce856fe4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1652-148-0x0000000000400000-0x0000000000433000-memory.dmp
        Download

        memory/1652-22-0x0000000000400000-0x0000000000433000-memory.dmp
        Download

        memory/1972-84-0x0000000000800000-0x0000000000830000-memory.dmp
        Download

        memory/2176-137-0x0000000005900000-0x0000000005942000-memory.dmp
        Download

        memory/2176-122-0x00000000057D0000-0x0000000005826000-memory.dmp
        Download

        memory/2176-145-0x0000000009390000-0x0000000009422000-memory.dmp
        Download

        memory/2176-142-0x0000000005D90000-0x0000000005D98000-memory.dmp
        Download

        memory/2176-143-0x0000000005DC0000-0x0000000005DD4000-memory.dmp
        Download

        memory/2176-141-0x0000000005BE0000-0x0000000005BEA000-memory.dmp
        Download

        memory/2176-129-0x00000000057C0000-0x00000000057CC000-memory.dmp
        Download

        memory/2176-140-0x0000000005A50000-0x0000000005A86000-memory.dmp
        Download

        memory/2176-138-0x00000000059B0000-0x0000000005A08000-memory.dmp
        Download

        memory/2176-139-0x0000000005980000-0x00000000059AC000-memory.dmp
        Download

        memory/2176-132-0x0000000005870000-0x00000000058A0000-memory.dmp
        Download

        memory/2176-126-0x00000000057A0000-0x00000000057B6000-memory.dmp
        Download

        memory/2176-113-0x00000000008E0000-0x0000000000A5E000-memory.dmp
        Download

        memory/2176-116-0x0000000005240000-0x00000000052B0000-memory.dmp
        Download

        memory/2176-119-0x0000000005740000-0x000000000576C000-memory.dmp
        Download

        memory/3156-91-0x000000000B600000-0x000000000B60E000-memory.dmp
        Download

        memory/3156-90-0x000000000B630000-0x000000000B668000-memory.dmp
        Download

        memory/3156-36-0x00000000059E0000-0x0000000005A50000-memory.dmp
        Download

        memory/3156-33-0x0000000000DC0000-0x0000000000F3A000-memory.dmp
        Download

        memory/3156-77-0x0000000006400000-0x0000000006414000-memory.dmp
        Download

        memory/3156-42-0x0000000005E10000-0x0000000005E62000-memory.dmp
        Download

        memory/3156-65-0x0000000005F20000-0x0000000005F4C000-memory.dmp
        Download

        memory/3156-74-0x00000000063D0000-0x00000000063D8000-memory.dmp
        Download

        memory/3156-78-0x00000000064A0000-0x00000000064F0000-memory.dmp
        Download

        memory/3156-59-0x00000000065C0000-0x0000000006B66000-memory.dmp
        Download

        memory/3156-68-0x00000000060B0000-0x00000000060E6000-memory.dmp
        Download

        memory/3156-39-0x0000000005D80000-0x0000000005DAC000-memory.dmp
        Download

        memory/3156-45-0x0000000005DB0000-0x0000000005DC6000-memory.dmp
        Download

        memory/3156-89-0x0000000009CC0000-0x0000000009CD0000-memory.dmp
        Download

        memory/3156-86-0x0000000009B80000-0x0000000009B88000-memory.dmp
        Download

        memory/3156-62-0x0000000006010000-0x0000000006064000-memory.dmp
        Download

        memory/3156-71-0x0000000006200000-0x000000000620A000-memory.dmp
        Download

        memory/3156-79-0x0000000006420000-0x0000000006432000-memory.dmp
        Download

        memory/3156-48-0x0000000005D70000-0x0000000005D7C000-memory.dmp
        Download

        memory/3156-80-0x00000000064F0000-0x000000000652C000-memory.dmp
        Download

        memory/3156-51-0x0000000005E70000-0x0000000005EA0000-memory.dmp
        Download

        memory/3156-56-0x0000000005F60000-0x0000000006008000-memory.dmp
        Download

        memory/3636-144-0x00000000009C0000-0x00000000009F0000-memory.dmp
        Download