689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c

Analysis

max time kernel
147s
max time network
109s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
Size

361KB
MD5

f9f40f5e067fdd7ddd9f31044c6d774b
SHA1

cd249fcff76dc9bf278c43423a723bc9f841b8e2
SHA256

689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c
SHA512

80aef6132b1769e40a3a6324dd9636c36febc80f93edfa33f851316bdb1d9e91af1102b3dae11965e1def013abc181891b7b670b5e2556dac4f044399414768b
SSDEEP

6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
884	zatrstuvtmnopqoh.exe
1636	CreateProcess.exe
1020	vvutsjihhg.exe
568	CreateProcess.exe

Loads dropped DLL 4 IoCs

pid	Process
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
1020	vvutsjihhg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
552	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033f9092ec28e0b4aacc5e400df5e147e000000000200000000001066000000010000200000002a857e0996b0e9eaf88a79c565dd9aeea9749378b22b9e405a3a1203aa203e5b000000000e80000000020000200000009c26080f69f09b5773f3f638ebb5ac4e0876f7deafcfe8ca2962a2c62f5bd6db20000000d5e03e59298ee9d5812393fff0a7b0fb3605f9eceb77b7e4470a43201ed69aed400000000bfa164608f3122248f7d84eac4f76e9eac54e5805077623991f1e200605681091f16c833e2f4a4c1cdfda95a11d0746bfe3be7c1190023f6877cfb5826f6731	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033f9092ec28e0b4aacc5e400df5e147e000000000200000000001066000000010000200000008df072e6cadf5a36c3abe21cb780fd55e6dc8a5c7284d698b5fa4bdff35761d4000000000e800000000200002000000020aed54745e8b72f03fb84100387343e8bc1d82fdc04e1604b27b34f330655c0900000008f8bab716262d969515bd5f0969ddbf05b6a9f71b31b549174c4c12b1781cd25a6cfd8bfba8a60c43834221e6036f63d3b41fa9ffbe002671f08006ce1496a15e99353b2c6763ca2ba283bc57c6e0ca7837acea5fc3c683b8bca8956668c5f69d9c7778f8e00a3b0f284e53310668742192530e846bc268a4e4649a483e8080877682a5c0a778da30381ffc4cb1c4266400000004de787a81365dbda1e4d3026da34511d8fc1612b9c0c77886d3d6aefed7725a235b88ffc86a87b8cdd1d2b2efc9e553fd61fe0bdd959f6e2b31ef23593290b2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801f73abcb09d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6BD2CE0-75BE-11ED-A34F-EA25B6F29539} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
884	zatrstuvtmnopqoh.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe
1020	vvutsjihhg.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 884	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	28
PID 800 wrote to memory of 884	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	28
PID 800 wrote to memory of 884	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	28
PID 800 wrote to memory of 884	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	28
PID 800 wrote to memory of 1368	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	29
PID 800 wrote to memory of 1368	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	29
PID 800 wrote to memory of 1368	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	29
PID 800 wrote to memory of 1368	800	689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe	29
PID 1368 wrote to memory of 1860	1368	iexplore.exe	31
PID 1368 wrote to memory of 1860	1368	iexplore.exe	31
PID 1368 wrote to memory of 1860	1368	iexplore.exe	31
PID 1368 wrote to memory of 1860	1368	iexplore.exe	31
PID 884 wrote to memory of 1636	884	zatrstuvtmnopqoh.exe	33
PID 884 wrote to memory of 1636	884	zatrstuvtmnopqoh.exe	33
PID 884 wrote to memory of 1636	884	zatrstuvtmnopqoh.exe	33
PID 884 wrote to memory of 1636	884	zatrstuvtmnopqoh.exe	33
PID 1020 wrote to memory of 568	1020	vvutsjihhg.exe	35
PID 1020 wrote to memory of 568	1020	vvutsjihhg.exe	35
PID 1020 wrote to memory of 568	1020	vvutsjihhg.exe	35
PID 1020 wrote to memory of 568	1020	vvutsjihhg.exe	35

C:\Users\Admin\AppData\Local\Temp\689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe
"C:\Users\Admin\AppData\Local\Temp\689b246593f0e8c5c8ac91d2ef9214a7cb8c865e5590a62230bd0232bcdeb79c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:800
- C:\Temp\zatrstuvtmnopqoh.exe
  C:\Temp\zatrstuvtmnopqoh.exe run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vvutsjihhg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1636
  - - C:\Temp\vvutsjihhg.exe
      C:\Temp\vvutsjihhg.exe ups_run
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
C:\Temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
C:\Temp\vvutsjihhg.exe

Filesize
361KB

MD5
d603eed7179e288b293521f5917d11ea

SHA1
f9604f2760283cbd4452d90531eb8d0ec207aebf

SHA256
9da6b21759a4534719663beb04075b859b941d3ef3c5613a98f27796cbed27cb

SHA512
76626d4a4bfd5944885978095b956fcdb54c9e917c884a475ce2c1d80c1c632682ad4e7eb20b02e53762e599e71005f70261d41f13135ef47f8c91e4ce0a607f

Download Submit
C:\Temp\zatrstuvtmnopqoh.exe

Filesize
361KB

MD5
33ee22e7ff5a11449987ebd6485c4b0f

SHA1
82c89490b9499de6ce6568cb5c85dbb5b14f1feb

SHA256
484bbc80f3159567adf19920ad1ad2ab1a6439c15455515bb586c91ebb5d0791

SHA512
7b3d813ac0c9d4ee6172c5ed9ce833842c033d3b2a74ab02aa591ef92b4a709dad200565615b948850b6a79ea70b8c3a95431523138110fbbc724aa75de22d69

Download Submit
C:\Temp\zatrstuvtmnopqoh.exe

Filesize
361KB

MD5
33ee22e7ff5a11449987ebd6485c4b0f

SHA1
82c89490b9499de6ce6568cb5c85dbb5b14f1feb

SHA256
484bbc80f3159567adf19920ad1ad2ab1a6439c15455515bb586c91ebb5d0791

SHA512
7b3d813ac0c9d4ee6172c5ed9ce833842c033d3b2a74ab02aa591ef92b4a709dad200565615b948850b6a79ea70b8c3a95431523138110fbbc724aa75de22d69

Download Submit
C:\temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
\Temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
\Temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
\Temp\CreateProcess.exe

Filesize
3KB

MD5
553ecd3b00fccb6eab67e6e3c1a38a0f

SHA1
ce6334b596103931697778f409cb062484c3665d

SHA256
c1c714f128a8454584c47815a1ef8d495b7657dcaf91a85e52d51bf833f20ed5

SHA512
994c401372003516604de082f12fac53bd91122d84c6774451dce275d45e5b958d44e4286a5d75661145f6577a0d6ebf99890112fe869e85690a0a2c2398f14c

Download Submit
\Temp\zatrstuvtmnopqoh.exe

Filesize
361KB

MD5
33ee22e7ff5a11449987ebd6485c4b0f

SHA1
82c89490b9499de6ce6568cb5c85dbb5b14f1feb

SHA256
484bbc80f3159567adf19920ad1ad2ab1a6439c15455515bb586c91ebb5d0791

SHA512
7b3d813ac0c9d4ee6172c5ed9ce833842c033d3b2a74ab02aa591ef92b4a709dad200565615b948850b6a79ea70b8c3a95431523138110fbbc724aa75de22d69

Download Submit
memory/568-65-0x0000000000000000-mapping.dmp

Download
memory/884-55-0x0000000000000000-mapping.dmp

Download
memory/1636-61-0x0000000000000000-mapping.dmp

Download