ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Size

349KB
MD5

0d61814785eb1776ccb70b0899e2d81f
SHA1

f49aff6501da4b8d41761f68c7d2445bfceb32ce
SHA256

ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b
SHA512

c4e8e911ccdec315a3951bd89a34dbeada9fa8b787d0f8e86ba38a9de39421319e20e22e15740829fa818a6c48856ff3fa757e9436d6305aace3d9e9fbc781ef
SSDEEP

6144:ye340Hnu/EJXAF8u1qBhGNy4909VezjiGF+nh9CUZLcb+FPJ:yEJXs1q2N1906jidGUZLcb+FPJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
628	installstat.exe

Loads dropped DLL 4 IoCs

pid	Process
1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
628	installstat.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EditPlus\kk33.icw	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000353f94ed319d41d3c759de4460170339d9e8f766624ea41e34c5a511c7b89227000000000e80000000020000200000003d13d7e053b64a1017b183d3feee04d3b34c52c06a404ae2f6ecdf12ed40298f90000000f09cc6d003851465ce0cf100bf3552b7db8bb53e4e959503bc0878c4b33c748329bee9ddfdd465041b2fcbc3384f47b75569a80d66cfe1ce7c315d02af79207499e90f44f388f1fee4846938893dac3f21144daf3cc5d0c8380dce5e10003d0e791a2fc7758743b3a1aece227167edfab771426801cec8896ca903a31d8bf13e202b4089a1d5ebcc0fe0adc986ec7e804000000090aaa4ff289e22f83a1a04b0e1ad61c6d56ce983bc9d908704241b983fbaabfc5752c49161e56380f6f4ec324b9c3c8b9681a1c3241b3a307053746646181ce9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3011bc7d75f3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374678803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AFEB821-5F68-11ED-BF3D-D6AAFEFD221A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000006f7a2f32087f6a231a367962c3955d2b4c1bc3dfb473467326ab8e422f1444ca000000000e80000000020000200000000e1e18703ef176018dd178903a1dfb84789c75c60e05f55f81082ffc08288f992000000028760879f88e4558a5a695f9557fd31d7192e49c59f00f14ca69f848c3d9f97740000000fceac81f472d29b0403ca667a0f845dc16336289d03c2faa754d04ca37f6838b2984bdd471b6f9c756c170877fb40741b4c5110f1b3ac5eacc2a7ca09eca6d7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*"	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw\ = "icwfile"	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\ = "´ò¿ª(&O)"	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine\ = "VBScript"	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
Token: SeBackupPrivilege	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
888	iexplore.exe
888	iexplore.exe
272	IEXPLORE.EXE
272	IEXPLORE.EXE
272	IEXPLORE.EXE
272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 1956 wrote to memory of 948	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	27
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 948 wrote to memory of 816	948	cscript.exe	29
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 1956 wrote to memory of 628	1956	ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe	32
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33
PID 888 wrote to memory of 272	888	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe
"C:\Users\Admin\AppData\Local\Temp\ca1b26438cac897c0d3ae3da5c680a66442e84763ffe0ed404bbc94539bac62b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk33.icw"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWow64\WScript.exe
    "C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk33.icw"
    3⤵
    PID:816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EditPlus\kk33.icw

Filesize
132B

MD5
1ea58bdaf340b6242eb164a7b3cf504a

SHA1
32f9fe33357d610615acf3f1054c03a77d43af52

SHA256
ba49b5bfda6c0fd2200d4c7a853c71348e296487d7fbcc4d3a6871d19ff4cda8

SHA512
0f30378abce69e8b92e8b69b49c9384a4501de5a64e6ba978fed5fe33caf2bc0488c32f87a34510555f5e927d3f7e75307a9933e592372159a9e9ecf8a928f93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AAF2PHWI.txt

Filesize
608B

MD5
5ba3c0fcd661c422eeb9a837c3e15c01

SHA1
0cb3c6e78230a57b71f00bad9e1859e4ff4430d1

SHA256
bb7f37cfeb965d99d266cfa36fdfbf011254f110bd9f0a33f5402a1dc5b4271a

SHA512
e334bb6e57a21c141179d106c05da663ca2a6104e07f694ca9adf377833c2053854ddba144585f2d2f3c7c9ece56fd007c256d8a0c81cd69282b30ebcec5b23d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk33.icw

Filesize
842B

MD5
cef40a62b615883ae4ac46512ae83570

SHA1
b916dd1fcd6ebd7a3a24c65413d4d07d443007dc

SHA256
9f5b8af4a198a2e05c190e736a11545c4708da665e3b1810dcfdb7b95906ade8

SHA512
80d9391106a1af35d3a56e90f662aded1fca819c6aa3abd7639b7195168e2b2481a47c6e4aa14061994e34cfc69196e9bcefa1b2c69fc24e8512b4132915bfd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
cdadfa1995ac40ecdd51e83c0d67bf4f

SHA1
aa076ea83d578e4057ff9fd1e7923a497c133e8a

SHA256
56afc62c43b35ede478c5047be22cd8910022baa1d2d18108088009692e6fbd2

SHA512
75d44c6f643ba1711d823de2314734b2618df5408c4f2bc153796489452e73b15f9bff531fe23b0c34fc5259e6846bc399e17b50d2ce3e3f0d90bfc412eec5d9

Download Submit
\Users\Admin\AppData\Local\Temp\nstD3C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstD3C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
cdadfa1995ac40ecdd51e83c0d67bf4f

SHA1
aa076ea83d578e4057ff9fd1e7923a497c133e8a

SHA256
56afc62c43b35ede478c5047be22cd8910022baa1d2d18108088009692e6fbd2

SHA512
75d44c6f643ba1711d823de2314734b2618df5408c4f2bc153796489452e73b15f9bff531fe23b0c34fc5259e6846bc399e17b50d2ce3e3f0d90bfc412eec5d9

Download Submit
memory/1956-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download