1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer_v3500_x64.exe
Size 18.1MB
Sample260802-ralfzsthpe
SHA256 1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48
MD5 18b77efc3df7f3bb6a679bc1992f8e22
SHA1 2dd37623bf004afd71de115107557c58c250fb43
SHA512 3fae9848afc40d2a5a820fa120725bd1fb84cec11ceafa8f9ce115f0dc605b895086ccd7e46bad85c13c6a7beedd014578e21cc43816ef8667af3343204bfa80
SSDEEP 393216:bdD4BJwgJfJAQeqKZhSMOZUa+8CGpaahVnTIZRnyxnubo:2LBk1qshIjppVanYnub
TLSH
T10C17331CA8BE884AD59C37B04A02D059D70E5F3B980B0C6F6BDB663DD41E4538E78B76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence themida trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ioextender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	ioextender.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer_v3500_x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ioextender.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe
1896	powershell.exe
1224	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ioextender.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer_v3500_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer_v3500_x64.exe

Executes dropped EXE 2 IoCs

pid	Process
4824	InterPartHKIAsync.exe
5368	ioextender.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5460-7-0x0000000000400000-0x0000000001D90000-memory.dmp	themida
behavioral2/memory/5460-8-0x0000000000400000-0x0000000001D90000-memory.dmp	themida
behavioral2/memory/5460-67-0x0000000000400000-0x0000000001D90000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer_v3500_x64.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
5	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5460	Installer_v3500_x64.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5240	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ioextender.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ioextender.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5420	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1224	powershell.exe
1224	powershell.exe
1896	powershell.exe
1896	powershell.exe
4824	InterPartHKIAsync.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe
5368	ioextender.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	5460	Installer_v3500_x64.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeIncreaseQuotaPrivilege	1224	powershell.exe
Token: SeSecurityPrivilege	1224	powershell.exe
Token: SeTakeOwnershipPrivilege	1224	powershell.exe
Token: SeLoadDriverPrivilege	1224	powershell.exe
Token: SeSystemProfilePrivilege	1224	powershell.exe
Token: SeSystemtimePrivilege	1224	powershell.exe
Token: SeProfSingleProcessPrivilege	1224	powershell.exe
Token: SeIncBasePriorityPrivilege	1224	powershell.exe
Token: SeCreatePagefilePrivilege	1224	powershell.exe
Token: SeBackupPrivilege	1224	powershell.exe
Token: SeRestorePrivilege	1224	powershell.exe
Token: SeShutdownPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeSystemEnvironmentPrivilege	1224	powershell.exe
Token: SeRemoteShutdownPrivilege	1224	powershell.exe
Token: SeUndockPrivilege	1224	powershell.exe
Token: SeManageVolumePrivilege	1224	powershell.exe
Token: 33	1224	powershell.exe
Token: 34	1224	powershell.exe
Token: 35	1224	powershell.exe
Token: 36	1224	powershell.exe
Token: SeIncreaseQuotaPrivilege	1224	powershell.exe
Token: SeSecurityPrivilege	1224	powershell.exe
Token: SeTakeOwnershipPrivilege	1224	powershell.exe
Token: SeLoadDriverPrivilege	1224	powershell.exe
Token: SeSystemProfilePrivilege	1224	powershell.exe
Token: SeSystemtimePrivilege	1224	powershell.exe
Token: SeProfSingleProcessPrivilege	1224	powershell.exe
Token: SeIncBasePriorityPrivilege	1224	powershell.exe
Token: SeCreatePagefilePrivilege	1224	powershell.exe
Token: SeBackupPrivilege	1224	powershell.exe
Token: SeRestorePrivilege	1224	powershell.exe
Token: SeShutdownPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeSystemEnvironmentPrivilege	1224	powershell.exe
Token: SeRemoteShutdownPrivilege	1224	powershell.exe
Token: SeUndockPrivilege	1224	powershell.exe
Token: SeManageVolumePrivilege	1224	powershell.exe
Token: 33	1224	powershell.exe
Token: 34	1224	powershell.exe
Token: 35	1224	powershell.exe
Token: 36	1224	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4824	InterPartHKIAsync.exe
Token: SeDebugPrivilege	5368	ioextender.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1224	5460	Installer_v3500_x64.exe	88
PID 5460 wrote to memory of 1896	5460	Installer_v3500_x64.exe	91
PID 1896 wrote to memory of 4824	1896	powershell.exe	93
PID 4824 wrote to memory of 2056	4824	InterPartHKIAsync.exe	95
PID 4824 wrote to memory of 5368	4824	InterPartHKIAsync.exe	97
PID 4824 wrote to memory of 5240	4824	InterPartHKIAsync.exe	98
PID 5240 wrote to memory of 5420	5240	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','PathMarker.vbs','ioextender.exe','InterPartHKIAsync.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe
    "C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "Extended API 0136301" /TR "\"wscript.exe\" //nologo \"C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\PathMarker.vbs\"" /SC MINUTE /MO 20 /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2056
  - - C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\ioextender.exe
      "C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\ioextender.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zzhwbwdb.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5240
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5420

C:\Windows\system32\wscript.exe
"wscript.exe"
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0hspq5wu.2fb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hspq5wu.2fb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zzhwbwdb.bat

Path C:\Users\Admin\AppData\Local\Temp\zzhwbwdb.bat
Size 266B
SHA256 5d3dce1d2a3fca3e8a265a793e96e2c04de90571857dea4a1bd52c5a75d568d8
MD5 68ef020e350519dc052d81072a7ba721
SHA1 aca9f6a6790386031513b5be751be48cb9807ea2
SHA512 e5eee308aae4d085d73add37a227585e5ad4f76bc2270ad2a86d0e904341c7a18fb5f6bf3d071b0ce99f76509ad7f581b2bbc284a76d89947c39c6242f7c8dd9
TLSH
T1CED02B05224F07C940013D7207BF10C5397D50D22D842B41674440A962CF004D19A3C5
MD5 SHA1 SHA512 TLSH

Submit Download

InterPartHKIAsync.exe

Path C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe
Size 409KB
SHA256 640dd656adb4e1e264ed498dbcdcdbc15d8945435c40dd9ce8b0f2b5c208cf5c
MD5 e2b087b6221cdb7b480b49dcc066983c
SHA1 5a57087b370c584d1d682837c1647de1c72bcbad
SHA512 7180e1ae9826408f3f03a4162ad2bd89ecb26957a59dbc7bceb4ef83e7e6c2cfc27d252e850267e699136fd9291e21750154e51bc0e40507e66b85f994fb10a2
SSDEEP 6144:D/bKqHA9t9hmnshI5sr8TtOH+VDbOiAM0tAsx/E4k8dAYwuZ21:DWqWInsUrjbOiAM0asWl
TLSH
T1F1943A17B5898921C1905737C8EB620077F5EA8A72F7EB4D398623C90D033FADD86697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\ExtendedMonitor\install.dat
Size 72B
SHA256 d3f0675a618cd77e9720ffd0eb139d74154af228f580ac058b53f32c74444771
MD5 938df545e8f48e62e88882276a200210
SHA1 a4cd43127a1d9e2a7209378c2e3e15af7cebfc7a
SHA512 899e812a521793ebc3112ecb1627c52e41dc26d84250e9c9cdf2081c83014291ea751c4c4b7fd174642b7acea491b831f3abbc6f1dfcefff69ed18a0aa30412a
TLSH
T101A0220002CEAA0E8200E82303B200CCA0232003BE8C3B088BC0CE0A30C0C00B08830A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-28-0x000001A3ECED0000-0x000001A3ECEDA000-memory.dmp

Download

memory/1224-32-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-40-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-39-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-37-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-14-0x000001A3ECE30000-0x000001A3ECE52000-memory.dmp

Download

memory/1224-15-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-16-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-17-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-18-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-19-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-20-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-21-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-22-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-25-0x000001A3ED0F0000-0x000001A3ED10E000-memory.dmp

Download

memory/1224-27-0x000001A3ED110000-0x000001A3ED1C2000-memory.dmp

Download

memory/1224-26-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-36-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-29-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-30-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-31-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-35-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-33-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/1224-34-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/4824-53-0x000001DFF8470000-0x000001DFF84DA000-memory.dmp

Download

memory/4824-55-0x000001DFF89C0000-0x000001DFF89C8000-memory.dmp

Download

memory/5460-9-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-6-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-8-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/5460-41-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/5460-42-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-44-0x000000001F190000-0x000000001FF32000-memory.dmp

Download

memory/5460-7-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/5460-10-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-5-0x00007FFE33FFF000-0x00007FFE34000000-memory.dmp

Download

memory/5460-11-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-0-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/5460-1-0x00007FFE00000000-0x00007FFE00002000-memory.dmp

Download

memory/5460-2-0x00007FFE00030000-0x00007FFE00031000-memory.dmp

Download

memory/5460-66-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp

Download

memory/5460-67-0x0000000000400000-0x0000000001D90000-memory.dmp

Download