qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Size

676KB
MD5

dd119e4cab8169c27e5bb65f306ed792
SHA1

a93b6b76b8427caa20f2c041fbf50ba27d2b6aac
SHA256

06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2
SHA512

74f86cab700fe211152ce8b74166156c4feebc71c9f5907fafafca531b2f47af7e9d4d52409411e488e6dd4109e4823b915ff7129d7b2f9a416dde765a3a18cb

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597626

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1252	regsvr32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1828	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a46a468ee3f5ba0eb958d065c768911f1d15a63eedc75697404372a59e3b885106973610d356adbd13522b9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1bf6de502aebd0766d7f02019477af095819d6f7cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f6d35e2aebd0766d7f02019477af095b17dcf8cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1ef2d5502aebd0766d7f02019477af095d1cdaf6cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\147f8463 = ea32d25400b5aa39b7ab332a735344ba994b1207fca04b56f28c38dcd730700c6f251961b63d42795b9b02310d6a1afb16ca2400c29b805959d70687bf4cdf3c49b46ac11ed840348c2918d7e5323466bc45cf4432690aec193eaee24996c573894de961fd57b7d769786e0e723a2f6f037d09b64af61f76657664c3e517f404f03779208df218dbd180d0aeea404a9306c321b6f43ab1ca67a24d770afa72c4c5aae4eb45bf5e7150e10e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\163ea41f = 45cd7553c0216d0491447f88985b3d524f48ba2d94c6ee3625ce4321f1a9cf6e7d434f0042c0c4609ec3d3301134da455c617bee8e315dcd16ee52	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f3d4592aebd0766d7f02019477af095b1bdaf6cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f19f9d65b2aebd0766d7f02019477af095a16d8f8cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f0d65a2aebd0766d7f02019477af095b1fd8f9cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f19f2d0512aebd0766d7f02019477af095a1bdff8cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f9d15d2aebd0766d7f02019477af095a1ddef9cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\5ea93bdb = 56b603169035e0a49137b3bd4de1bcf2c7bc9f0d1d54f10ebdd1ce04315c622772d6465427eff837920abfdf853bc248	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f6d35e2aebd0766d7f02019477af095b19dbf9cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1ef5d2592aebd0766d7f02019477af095d18dcf7cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1ef8d15d2aebd0766d7f02019477af095d18dcf7cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\ae82c37a = fc2d36a238fc9e92b1b16304d9eb48010e8812b406b76bd0fc8006440a62b56fa85cc02bdbb8ecaef95ac9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\d38a8cf0 = 62b469f65c51e59c1e39256e827b19421a7f8f0d4d6dd3ff99259fd6e2c0b2cb2bc106bd7247bda847c92c0aee98ee7b92af9c6e9288a43d5d41c57df7d9358d999ad96402187ca487cfb826e4c582ca55c383c4eb21fd	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f0d65a2aebd0766d7f02019477af095817d7f6cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1ef5d2592aebd0766d7f02019477af095d1adafecf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f1ef8d15d2aebd0766d7f02019477af095d16ddf6cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a51a468ee0aed8aaa231d0ae1f9169477ae33a714fae2	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f9d15d2aebd0766d7f02019477af095a1fddfbcf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f18f3d4592aebd0766d7f02019477af095b1dd9f8cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\acc3e306 = efd0f47e8c00ea8c3c77804e429b6731f59c686bbf18479eec8c58a56f3ea200aac4fc9dc1bdf7e990aaf5a4818c7aaae0b145	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Libiavbf\21e0542d = ee9a4fa468ee3f5ba0eb94c70652728f19f2d0512aebd0766d7f02019477af095a1ddef9cf3e995907ccc6b5a2a03d583b37d7042d30	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1248	rundll32.exe
1248	rundll32.exe
1252	regsvr32.exe
1252	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1248	rundll32.exe
1252	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1248	1216	rundll32.exe	68
PID 1216 wrote to memory of 1248	1216	rundll32.exe	68
PID 1216 wrote to memory of 1248	1216	rundll32.exe	68
PID 1248 wrote to memory of 1932	1248	rundll32.exe	73
PID 1248 wrote to memory of 1932	1248	rundll32.exe	73
PID 1248 wrote to memory of 1932	1248	rundll32.exe	73
PID 1248 wrote to memory of 1932	1248	rundll32.exe	73
PID 1248 wrote to memory of 1932	1248	rundll32.exe	73
PID 1932 wrote to memory of 1828	1932	explorer.exe	74
PID 1932 wrote to memory of 1828	1932	explorer.exe	74
PID 1932 wrote to memory of 1828	1932	explorer.exe	74
PID 2872 wrote to memory of 1252	2872	regsvr32.exe	79
PID 2872 wrote to memory of 1252	2872	regsvr32.exe	79
PID 2872 wrote to memory of 1252	2872	regsvr32.exe	79
PID 1252 wrote to memory of 1804	1252	regsvr32.exe	80
PID 1252 wrote to memory of 1804	1252	regsvr32.exe	80
PID 1252 wrote to memory of 1804	1252	regsvr32.exe	80
PID 1252 wrote to memory of 1804	1252	regsvr32.exe	80
PID 1252 wrote to memory of 1804	1252	regsvr32.exe	80
PID 1804 wrote to memory of 2056	1804	explorer.exe	81
PID 1804 wrote to memory of 2056	1804	explorer.exe	81
PID 1804 wrote to memory of 1972	1804	explorer.exe	83
PID 1804 wrote to memory of 1972	1804	explorer.exe	83
PID 3560 wrote to memory of 3596	3560	regsvr32.exe	87
PID 3560 wrote to memory of 3596	3560	regsvr32.exe	87
PID 3560 wrote to memory of 3596	3560	regsvr32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ndhlmcefue /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll\"" /SC ONCE /Z /ST 09:08 /ET 09:20
      4⤵
      Creates scheduled task(s)
      PID:1828

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Eeziicg" /d "0"
      4⤵
      PID:2056
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Afxvuazct" /d "0"
      4⤵
      PID:1972

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll"
  2⤵
  PID:3596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-122-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1248-120-0x00000000735A0000-0x00000000735C1000-memory.dmp

Filesize
132KB

Download
memory/1248-121-0x00000000735A0000-0x00000000736E0000-memory.dmp

Filesize
1.2MB

Download
memory/1248-119-0x00000000735A0000-0x00000000736E0000-memory.dmp

Filesize
1.2MB

Download
memory/1252-131-0x0000000073300000-0x0000000073440000-memory.dmp

Filesize
1.2MB

Download
memory/1252-132-0x0000000073300000-0x0000000073321000-memory.dmp

Filesize
132KB

Download
memory/1252-133-0x0000000073300000-0x0000000073440000-memory.dmp

Filesize
1.2MB

Download
memory/1252-134-0x0000000000F50000-0x000000000109A000-memory.dmp

Filesize
1.3MB

Download
memory/1804-139-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/1804-138-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/1804-140-0x0000000000A60000-0x0000000000A81000-memory.dmp

Filesize
132KB

Download
memory/1932-127-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/1932-126-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1932-125-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download