9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Size

349KB
MD5

5de6e2937a87ab4d8a0158923e53fa00
SHA1

ee345c4babc190469629d28b6902c4b89fae6bf5
SHA256

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19
SHA512

ae5a72e98e4ccbe410e42231735e6f219d6906edf16c15b7df6a9da5cb891b2a7195f9556737eb61368aa631851e934373d166dcc651ca80e8a3db70bfd02470
SSDEEP

6144:ye34Q5Lnu/EJXAF8u1qBhGNy4909VezjiGF+nh9CUZLcb+FAV:6EJXs1q2N1906jidGUZLcb+FO

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

installstat.exe

pid process

4652 installstat.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cscript.exe

pid	process
4652	installstat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cscript.exe

Loads dropped DLL 4 IoCs

Processes:

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exeinstallstat.exe

pid	process
2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
4652	installstat.exe

Drops file in Program Files directory 1 IoCs

Processes:

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe

description ioc process

File created C:\Program Files (x86)\EditPlus\kk03.icw 9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files (x86)\EditPlus\kk03.icw	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000954aa9b806940d4b9ebc41944b0b8c1400000000020000000000106600000001000020000000f12063d3d0292f0fb77b000536a635fde33dd9f3ff58119aa47ef031f9ac71ea000000000e8000000002000020000000737d1e377f8a36f6be976b1d90c71660622e688aef26501adebe81274dc95c0520000000fdec88b435fc0db9b6e04b118b150044a34458dba08840817370126f0b5bdcf840000000f0df616573c069ed4b598811bbd8a0aec5bcf64aed2bd7a3e52ca67f9250ab3ccc27becaffd88816a0d6b435a928bfe8f8f39fa40c50cb4c17b6a326ec7c6151	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998387"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d052015273ffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375997318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7C83521B-6B66-11ED-89AC-D2A4FF929712} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1363638764"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003b575273ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1363638764"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000954aa9b806940d4b9ebc41944b0b8c140000000002000000000010660000000100002000000081c96ee0f516ec34ec695d94f464f6a16f2dd3234793d3e2c141bba016964b04000000000e8000000002000020000000a3301552ca009700b65743db1b9e7f015b0daf0e22b50f0458c867132c168fe020000000472cb9a05ad668ae10309ffc57561578e25eae2abacba0bb0b179098d0a9e65c40000000be12689834af47b5bdf2338506346abaf6ebb67477bd25ac94808bc8e70b92dc873f9bdc0b765bb34f494c498692634653d1bb123505faeb0048d2de8c6b8355	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Modifies registry class 11 IoCs

Processes:

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.execscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*"	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw\ = "icwfile"	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine\ = "VBScript"	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\ = "´ò¿ª(&O)"	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cscript.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3400 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3400 iexplore.exe
3400 iexplore.exe
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE

pid	process
3400	iexplore.exe

pid	process
3400	iexplore.exe
3400	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.execscript.exeiexplore.exe

description	pid	process	target process
PID 2568 wrote to memory of 380	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	cscript.exe
PID 2568 wrote to memory of 380	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	cscript.exe
PID 2568 wrote to memory of 380	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	cscript.exe
PID 380 wrote to memory of 4732	380	cscript.exe	WScript.exe
PID 380 wrote to memory of 4732	380	cscript.exe	WScript.exe
PID 380 wrote to memory of 4732	380	cscript.exe	WScript.exe
PID 2568 wrote to memory of 4652	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	installstat.exe
PID 2568 wrote to memory of 4652	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	installstat.exe
PID 2568 wrote to memory of 4652	2568	9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe	installstat.exe
PID 3400 wrote to memory of 2000	3400	iexplore.exe	IEXPLORE.EXE
PID 3400 wrote to memory of 2000	3400	iexplore.exe	IEXPLORE.EXE
PID 3400 wrote to memory of 2000	3400	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe
"C:\Users\Admin\AppData\Local\Temp\9006b20addb24a9c3956f25280e61edae5c1c0f0ea2763618d8d1ead570c4d19.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk03.icw"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk03.icw"
3⤵
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4652

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4760

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3400 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EditPlus\kk03.icw

Filesize
132B

MD5
523ecfafc0193b387d324c0c7958d4ed

SHA1
c5daddd5579ee65b4343b168387193b3f97fb34b

SHA256
88b34f157942b6f1238baa9893d40a9729a24960d008dfba05c6b7629f8bce81

SHA512
75e00f70bc2dfd77613b052daaeb08f5f8a10469551f6fdd722145985443c1b68781752589a9ab4cb8bb32f32e0a52c0aac40ae57a70a84a51b3b88ab3357038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk03.icw

Filesize
842B

MD5
9db3fa3ae9878737d7e13e24972caf6f

SHA1
87a3294f81cf0baacd4df15635fa7f5de25288f7

SHA256
3253e52c2423bf64b244c3d7dc62a2b9da56e10efc6908041ca30b535d9c9514

SHA512
30dd560b31e728dd7bd58affcf1194cfd88d754ff381d1edc37f673119b1acbe360ed3a10ccdbf8ec2552f0396930cab5e39a5fe9edcbb27aa106cd6d26af860

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
d07bbbe83fdf724da60c885b527b1cb7

SHA1
59b2e8e4f94348ea8b53fe8e5faea2ceb6beddcf

SHA256
b0db29b069d63ab9adad2ba43aa12c9ecac8f3ddf6f9c1ac9c05615c5f7fb664

SHA512
034efdb6ffe253345ea1c6348abc64a1eaf2c6ae674ea6f5c2deccb100c53045cebb645a19648a25b1adc53fd13968ddd9e947805e5ee8d3ea7a93b7ecef126b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
d07bbbe83fdf724da60c885b527b1cb7

SHA1
59b2e8e4f94348ea8b53fe8e5faea2ceb6beddcf

SHA256
b0db29b069d63ab9adad2ba43aa12c9ecac8f3ddf6f9c1ac9c05615c5f7fb664

SHA512
034efdb6ffe253345ea1c6348abc64a1eaf2c6ae674ea6f5c2deccb100c53045cebb645a19648a25b1adc53fd13968ddd9e947805e5ee8d3ea7a93b7ecef126b

Download Submit
memory/380-135-0x0000000000000000-mapping.dmp

Download
memory/4652-139-0x0000000000000000-mapping.dmp

Download
memory/4732-138-0x0000000000000000-mapping.dmp

Download