c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Size

95KB
MD5

4eedf8bf372c39c75a50075600bff2db
SHA1

7ba3c1eddd267004386ef94347d26cc4a88cc655
SHA256

c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc
SHA512

f363e156f67888fba1067f84018a6488f45ebd0fe0a5b83a5655179724286a212caeb2c88707ada5615b554e5b2a5135b16fba51643d3515fdcb3edc6a0a3f6d
SSDEEP

1536:EpgpHzb9dZVX9fHMvG0D3XJ3B/f2gUBglcADKd56zAmxFGlbJUcFJVKM5aUro:ygXdZt9P6D3XJ3JOgkjADKd5H+FkFJnw

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1324	installstat.exe

Loads dropped DLL 4 IoCs

pid	Process
1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
1324	installstat.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EditPlus\kk42.icw	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBFEFF60-752A-11ED-8499-660C31E8D015} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377071216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d6b7b73709d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019178666df5ae248bbee6f825bc6919f00000000020000000000106600000001000020000000a2b98382358880dc0ec518737309004a1a46bc2c8cfed8f742f88a5a409344d4000000000e80000000020000200000001543b72e3d4fd299bbf782b45a6353db8ac8f3acc4829bd330ec8014b348ce5d900000009732e0c5719af417ab8f5c3b3e42000c9d962c825f82bd805e76f119a4e6b86b4ceb853024059e755fe1bb144ae3743cb24e2475431e4a98fbabd6058fcdb877b3bad75ce54d0df29132e5fd888b774c5a27ff2293a82750e8e220ead4993cab45b7257cf0afdebfcb471ed3374f62eb1c20d1cd769dc7419fa58e1b10d94565a4d96e9c491d393afd5b599b1d19cbd340000000cb320ce9d76811bb47a124c90f63811e6b40d88f9415357f3d8dd0d9f2ff2bf5a0ed129bc6814197fe0e38e35f8842577e66ddeb808bb8383855b26543598350	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019178666df5ae248bbee6f825bc6919f000000000200000000001066000000010000200000009f31431ec8a7140734c7296b626931d7df30310f17a81ca9bb4fcd6f0929c1cb000000000e8000000002000020000000434422f16eedd5987b32247160657e9cb880f968f5e6cd961923274fc1843cb0200000002ff4426410c17b49359a4540084235bdd1c40085ed78b86206a1be073fb7d9ab400000005c5e5dddf11416fe0787903a736f22492393faf9c165b452f52e775efd779a61e09799ca891e53d102af2e06b176a99c567dd43c5a00393e3dd66f39bb114a5d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*"	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw\ = "icwfile"	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine\ = "VBScript"	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\ = "´ò¿ª(&O)"	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
Token: SeBackupPrivilege	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1356	iexplore.exe
1356	iexplore.exe
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1708 wrote to memory of 1640	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	26
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1640 wrote to memory of 976	1640	cscript.exe	28
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1708 wrote to memory of 1324	1708	c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe	30
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32
PID 1356 wrote to memory of 1212	1356	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe
"C:\Users\Admin\AppData\Local\Temp\c26cc3d38d881060e6abcf4cbf13ebb42b538a4e912c52d8068ba397523dcddc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk42.icw"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWow64\WScript.exe
    "C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk42.icw"
    3⤵
    PID:976
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EditPlus\kk42.icw

Filesize
132B

MD5
17d3ed508b8e08416d70679bcca77cb7

SHA1
f3c5e2ae93500ee5f21b08c11f1a80e99b4bbf88

SHA256
96665d956d22876f8e4bbd8ed67e17d6aaacc2500a4aa6f3dcd257107392eae1

SHA512
14e69e712ce82c25b971a734a18cff1887608dd2fe1736455aca67a53be3056ffa2130f676eb734eb124894eb7696f168e6246a3d58668cab8f6e1a23b7d9ca2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YVAOSHTM.txt

Filesize
606B

MD5
66734f3ce3265b6f3a9a84d644492694

SHA1
490e57d0b529da92898469c4cfdc19fe69874b68

SHA256
fbc4c4cbada3efcf709db7412e53e79a07019c2d8ddc3fa2083a40b027bd8f8f

SHA512
77fde4cdd574a2a6c8588e17c369ebbda33e3810c60ae28389e78b44388c022f49466bdd2a5c7e2652a0f64bcb496f72b8593c1b5937f015375a5df59c271602

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk42.icw

Filesize
742B

MD5
a6975196a17ca355234234af05c9f30a

SHA1
5afdcea9ec5992b9e7a5fc01d330a5684f15d16e

SHA256
6918913bad2b92bc722fc5e59eb19cf3370de253ef3fc96bdc9290c8048ea22d

SHA512
f03ce0b50de3bb635469b092cd028a5d1ced95b8d0b48f096484e9c2f7b5f20b1c1307652c8f1cb94a14f6fb20efd01138de2ccd2f7288438020839fbe05b368

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
d2a43490acc2c80d87139db0dedb537e

SHA1
8f36e5865a03511b04961692af6053ce4365db96

SHA256
b9e841ae979cff45a71df03cdc18a7908cc36a79d2aa72896714248be818644d

SHA512
d8b3382755848e0b53b785054effd034546eb5919b4c1f248de484a56342ebe5d62a2ff3f4629e72361e32bad0cee179d5eaedaf9508e106ef74740413197a34

Download Submit
\Users\Admin\AppData\Local\Temp\nso8613.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso8613.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
d2a43490acc2c80d87139db0dedb537e

SHA1
8f36e5865a03511b04961692af6053ce4365db96

SHA256
b9e841ae979cff45a71df03cdc18a7908cc36a79d2aa72896714248be818644d

SHA512
d8b3382755848e0b53b785054effd034546eb5919b4c1f248de484a56342ebe5d62a2ff3f4629e72361e32bad0cee179d5eaedaf9508e106ef74740413197a34

Download Submit
memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download