Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:47

General

  • Target

    ad49dd256adedfa2be9188ec3f68cb75.exe

  • Size

    1.6MB

  • MD5

    ad49dd256adedfa2be9188ec3f68cb75

  • SHA1

    fe2b02b3d63339ca976759c0e450f82c288b8f3b

  • SHA256

    78dd9812c391c45f55ae45735371b6ac7d9f84aba107da824895be3b1d3250e1

  • SHA512

    d20c1b37e4ae6fe1cf0451037192299939beabfa9eebf1d103481370a7c730d843d2ec3eae0483e6dfa27bd088d6d1f9539b033ea0f82d7379723ea245d622fc

  • SSDEEP

    49152:BTouQ/MlgHcg1OeuDBLWoaOlJgbJrypAgLWnl:xouQ/olWglwrDJl

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad49dd256adedfa2be9188ec3f68cb75.exe
    "C:\Users\Admin\AppData\Local\Temp\ad49dd256adedfa2be9188ec3f68cb75.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
          • Drops startup file
          • Accesses Microsoft Outlook profiles
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
            5⤵
            • Creates scheduled task(s)
            PID:3004
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
            5⤵
            • Creates scheduled task(s)
            PID:2388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2900
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies system certificate store
      • outlook_office_path
      • outlook_win_path
      PID:2972
  • C:\Users\Admin\AppData\Local\Temp\3488.exe
    C:\Users\Admin\AppData\Local\Temp\3488.exe
    1⤵
    • Executes dropped EXE
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\3488.exe

    Filesize

    401KB

    MD5

    f88edad62a7789c2c5d8047133da5fa7

    SHA1

    41b1f056cdda764a1c7c402c6fa4f8ab2f3ce5f9

    SHA256

    eb2b1ce5574096b91eb9e0482117d2518ab188c0747a209dc77e88d30bb970dc

    SHA512

    e2d5b0ace5dfd3bd2321b2a42b7e7725071ca440389dc5ef12720a34727ae84c2907cd7befeae5d53568d9deaee8443f4cbda44b598cfc9b6316d9389be09a60

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    465KB

    MD5

    b2ab4f4594d5651c0e797ccbfd9531a1

    SHA1

    db093f5b3b4324834f5882111d815568a48006a4

    SHA256

    1cc55eb083022063c4885a015348f1664eadd8152c72d807c0026a66623b51cb

    SHA512

    be3c30446bceb040a17d315797077667e85757998299f38d821ef737424d792e0a6ce8db7cc59cfeeeb32bf6950e35f4428e1e69e22273ca7bf0b032924dd674

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    443KB

    MD5

    67c695ccd6a758e64c772fcb07331502

    SHA1

    d7af6ba4b04c437c46dc9383d32ef87670771e6e

    SHA256

    0e10ac9d6c88794c712e58b0b4777b8a268118b89d9faa49481dd76a4c046715

    SHA512

    cf8e1b89058c862f500c198241c23a1dbe99d09e261a75ba512f1a2aa17535c4f7c8f09eb1c33b573528d00c7da3c3418080c7cde367a7ca835ab0e25c07182d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    142KB

    MD5

    6fb13f081aa2afdb105e2a39d604b2b7

    SHA1

    03f230f66d3371c755bbf2673f861f99f775c620

    SHA256

    fa202544d4b33ce63d3c74a7b00f2e9ac9c222d930b2946195cba55a4fc65561

    SHA512

    6ce6bd6b0ddf993473a1c3d7168300851d0473c71b670eda512c945bf4f95ecf62863cbf98e1865582d84b779ef8904929471365faa0c1dd469768c91d2d1b24

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe

    Filesize

    37KB

    MD5

    7b4b527e87299f96a5094c09a47a5766

    SHA1

    b992a44e6d2b55353c9d1bc546b31223a63864f3

    SHA256

    1d6cb99c74f653f94dccfce32a3a9386e2cc883e79136bd62cc7238d49808c6a

    SHA512

    e9865754261e665356dcaabfdc6444b2de5440f35eb853cc5a1ae021447c0da555484533e311ada19a423f7677bff65d0fefcd4e2c064b676f3b52364846d9b4

  • C:\Users\Admin\AppData\Local\Temp\Tar8898.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\grandUIAMDtRsFpG6HeZi\information.txt

    Filesize

    3KB

    MD5

    d0fde51bbc35bceebd1d755cabc7a1d6

    SHA1

    adc667d0e2c7d00b8883fccafbdf5ecec6f6bd3c

    SHA256

    8358744e509477d10c6634d06a7ba23e56b1387d4d8532c6dcfeec447bc09c3b

    SHA512

    ba36e92522a5f68c5a134127088203e11d5305662d0c3944a8e71439322c8f6a2e5c81677a8841d7604253e8e2725d0969c8e59c1f898e93df729398960eaf81

  • C:\Users\Admin\AppData\Local\Temp\grandUIAMDtRsFpG6HeZi\passwords.txt

    Filesize

    4KB

    MD5

    974cc190d5703018c01ce08b904e227b

    SHA1

    b4f0f2a72907fcf9551846411a7221f60a88f97d

    SHA256

    204a93e1274c57f489adb21e0bf56064624582bb3b79fd59ba779ec8a137d8ff

    SHA512

    1949cd5ef9ae8ecb93c47e777dd183e758744d5768d024848e462b5416034d7d5cb2a9190d6ac7a2b8151380910ecde4df9396a8e9910b0582015a4923e7103e

  • C:\Users\Admin\AppData\Local\Temp\posterBoxMDtRsFpG6HeZi\02zdBXl47cvzHistory

    Filesize

    148KB

    MD5

    90a1d4b55edf36fa8b4cc6974ed7d4c4

    SHA1

    aba1b8d0e05421e7df5982899f626211c3c4b5c1

    SHA256

    7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

    SHA512

    ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

  • C:\Users\Admin\AppData\Local\Temp\posterBoxMDtRsFpG6HeZi\D87fZN3R3jFeWeb Data

    Filesize

    92KB

    MD5

    8fff4afa5c28dcfdfb7bac7c3950841d

    SHA1

    dd3fbd23bf6ca1bcdd15e6c984d676e43cf4dfc4

    SHA256

    c454b6533ff9fb8d73697fb7845adc2463ecc3a69e926de5dadb17f1012f6203

    SHA512

    bcd79fa0ddef1138fe6b47295d5ea491546bb9399a723ce6984f3139ae6fc6e98d0ca764120aa65a670db46c75143b493676d161cabd863f26d1950ade69412a

  • C:\Users\Admin\AppData\Local\Temp\posterBoxMDtRsFpG6HeZi\D87fZN3R3jFeplaces.sqlite

    Filesize

    5.0MB

    MD5

    ffb739db1355592aed5aaf4ac178d6e8

    SHA1

    071394b99508d5faaa81bd9f698172d789375d8e

    SHA256

    30be1bc16e903f795e6ebda1731c9ffcf251edb5712915216577ec4c67f65ca6

    SHA512

    a85e8de79f205cc48ccc33eb9c5f7456e28bb5b2fbcb9c77d3b4cc7ced7a3d5aa8c7350fcfb48db5e4232b6b69667c231afec41948ea5cab0e0b29a4eb2b870c

  • C:\Users\Admin\AppData\Local\Temp\posterBoxMDtRsFpG6HeZi\Ei8DrAmaYu9KLogin Data

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\Users\Admin\AppData\Local\Temp\rise131M9Asphalt.tmp

    Filesize

    13B

    MD5

    2ebf6338aa9569651865b4c289fb9b92

    SHA1

    c33544b1ea00ce3742e117719e2d4d6a86476081

    SHA256

    c0e52c57dd2a1abb3285c45cce8e630b5f82ccc89131d8651e992184c52be3b8

    SHA512

    96b762fc6ee8a251f1464ad0074bc3a49968e6dec5a64e57aef91d7cfff5a22e1f7b3b2a09a4ab0acbb56c0216c57cdd7626f5575af9905886847c6edb0af163

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

    Filesize

    1KB

    MD5

    d508ee3c21c873c1a90c66dcee6b1501

    SHA1

    f1e7d2d33db810c15903c7e855210d7982e5f4f2

    SHA256

    551959b0ae48512d5ae8d7ce15580f052e6057521b7a223c79d200536cc9cf67

    SHA512

    76de2d5aaafe433be1f5bfd4f32b066eaf6490b5372f2fca34c2203475f265838fc6f2ce2501f5a77c92b0b9671e93d04eb2eb9e76f4672ebd2cc1d01d3c9440

  • C:\Windows\SysWOW64\GroupPolicy\gpt.ini

    Filesize

    11B

    MD5

    ec3584f3db838942ec3669db02dc908e

    SHA1

    8dceb96874d5c6425ebb81bfee587244c89416da

    SHA256

    77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

    SHA512

    35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

  • C:\Windows\System32\GroupPolicy\GPT.INI

    Filesize

    127B

    MD5

    7cc972a3480ca0a4792dc3379a763572

    SHA1

    f72eb4124d24f06678052706c542340422307317

    SHA256

    02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

    SHA512

    ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

  • C:\Windows\System32\GroupPolicy\Machine\Registry.pol

    Filesize

    1KB

    MD5

    cdfd60e717a44c2349b553e011958b85

    SHA1

    431136102a6fb52a00e416964d4c27089155f73b

    SHA256

    0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

    SHA512

    dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe

    Filesize

    1.6MB

    MD5

    a62ae51d8c650079d2769d4384a4bd13

    SHA1

    517142dfaf4ecf361e8be3ccda47dcf682eb1da1

    SHA256

    3886542c0796c1b7239aa3dffc81f2d6d7f3dacd0fd5d8adca11807e7433ebbd

    SHA512

    823023d109f244b0d588cb6829d6432bd5f2fd849c071fa5253d70557d19f5ea446079a15bcd3bf78f716f5f985381cb880683024ce555fe3c218172118bbefa

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe

    Filesize

    935KB

    MD5

    a9f0755518f7b32840de5ee0a96e20e4

    SHA1

    df640c0b6c99529a67befc9fae50141e4c176ebb

    SHA256

    adc0697873fb5f526c9edd475f7b4bfd3556346f7e1cfe2b30dcdf751edff5b4

    SHA512

    8f854804552bd1178aa4820f8be7d1175f83469f20d56526dcad3a81527b10834dee8ab44ecca46d9084a59af79887af9d19c7c7acdf8dbac01df65e74798d78

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    528KB

    MD5

    ddf13a8ea12ffc5b2f93f58697289fa1

    SHA1

    9ded6bf94ef86d7e4c2f1e7a03bc82aedf169cd6

    SHA256

    3d72d66485a5c25f7923561d840ef66a1d78d670736925a6092c4348882dd870

    SHA512

    ec0c9ddb74dadad86e782d416ca34ed9af7a8e9a626420c9601dce6b962769bd5d7aa969d622fc306091709b632884a49d72e5bd53a635377c223114c26776db

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    697KB

    MD5

    6d08501f1d02fe25c528690f8544725c

    SHA1

    159ba5981d2b7538e0b822a278901294f36dfc70

    SHA256

    8949ae972c7955cf9c9620803dab37a6b3ba4b4d4b3946311fb4653572902f2b

    SHA512

    1aff81887552dee275a3e972b5f959c90cb00af5f3f7ad2f691cc423100f824e7cf79c96b3cc5dd07ea4d41a698c3fd2f7ad98f56d0dbc231905002b3c9efd6b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

    Filesize

    71KB

    MD5

    3dba64eb4588b621a25a087f7e834cf8

    SHA1

    730445da8381e5bbdcf15dbd1b59751056845f8b

    SHA256

    1ea105695e853a67317f337f9dbf259b01b1cdc0e33deff9ec6d4bef6b1d0bcd

    SHA512

    9fc0523cbe87d3efdccbb41c890aef5372ca63621b1a09cdc3c3360b9268f0908ff68ef25f980495981abb89318c9a63379325f01bad45f927ef6177de14f33c

  • memory/1336-139-0x00000000025A0000-0x00000000025B6000-memory.dmp

    Filesize

    88KB

  • memory/2292-223-0x0000000000170000-0x00000000001AC000-memory.dmp

    Filesize

    240KB

  • memory/2712-65-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-33-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2712-128-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-117-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-104-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-144-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-140-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-49-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-29-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-31-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-34-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-103-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-51-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-23-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-27-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-25-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2712-24-0x0000000000400000-0x0000000000598000-memory.dmp

    Filesize

    1.6MB

  • memory/2900-48-0x0000000000020000-0x000000000002B000-memory.dmp

    Filesize

    44KB

  • memory/2900-141-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2900-47-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2976-43-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2976-46-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB