quasar | 8d6cb8b53bb014815990250638364db29445ef2d2db6eab813933f8f12e60ff4

Analysis

max time kernel
7s
max time network
11s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ItroublveTSC-master/ItroublveTSC.exe
Size

2.0MB
MD5

7c2da2ae36228b8b66ec5e5029e90d08
SHA1

d636baf89fd305a1f694611097ac6e7bcb1f244c
SHA256

c6820f426b28b93295ca3b768780e8b372424fb72e94b5d0c094b030f53d4721
SHA512

93cbc698211b0ab0f96ab3f0eb8d393bcd04580418e08fc6df9b935a7cdd091b619a0edab4771b4c887264b0eef6846e6e08a7be24a8681848a1885206a29960
SSDEEP

49152:DL+qgtiXBVLcHD/QmJqRsVEzCeePMAnUD:OzcBVYHDjcyVMukAUD

Score

10^/10

quasar venomrat office04 evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

zaidtheboii-50153.portmap.host:50153

Mutex

VNM_MUTEX_fNWmZ9wa8oprRXUo73

Attributes

encryption_key
PJRTtGrfOi1c09c0GCYT
install_name
OneDrive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft One Drive
subdirectory
Microsoft One Drive

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe	disable_win_def
behavioral1/memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp	disable_win_def
behavioral1/memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Microsoft OneDrive.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Microsoft OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Microsoft OneDrive.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe	family_quasar
behavioral1/memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp	family_quasar
behavioral1/memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

596 cmd.exe
Executes dropped EXE 3 IoCs

Processes:

ItroublveTSC.exeMicrosoft OneDrive.exeOneDrive.exe

pid process

3068 ItroublveTSC.exe
2556 Microsoft OneDrive.exe
2528 OneDrive.exe

pid	process
596	cmd.exe

pid	process
3068	ItroublveTSC.exe
2556	Microsoft OneDrive.exe
2528	OneDrive.exe

Loads dropped DLL 8 IoCs

Processes:

ItroublveTSC.exeMicrosoft OneDrive.exeWerFault.exe

pid	process
2940	ItroublveTSC.exe
2940	ItroublveTSC.exe
2556	Microsoft OneDrive.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Microsoft OneDrive.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Microsoft OneDrive.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Drops file in System32 directory 3 IoCs

Processes:

Microsoft OneDrive.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe	Microsoft OneDrive.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe	Microsoft OneDrive.exe
File created	C:\Windows\SysWOW64\Microsoft One Drive\r77-x64.dll	Microsoft OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 2528 WerFault.exe OneDrive.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2460 schtasks.exe
1984 schtasks.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

924 PING.EXE
552 PING.EXE

pid	pid_target	process	target process
1684	2528	WerFault.exe	OneDrive.exe

pid	process
2460	schtasks.exe
1984	schtasks.exe

pid	process
924	PING.EXE
552	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exeMicrosoft OneDrive.exe

pid	process
2864	powershell.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

ItroublveTSC.exeMicrosoft OneDrive.exepowershell.exeOneDrive.exe

description	pid	process
Token: SeDebugPrivilege	3068	ItroublveTSC.exe
Token: SeDebugPrivilege	2556	Microsoft OneDrive.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2528	OneDrive.exe
Token: SeDebugPrivilege	2528	OneDrive.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ItroublveTSC.exe

pid process

3068 ItroublveTSC.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ItroublveTSC.exe

pid process

3068 ItroublveTSC.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OneDrive.exe

pid process

2528 OneDrive.exe

pid	process
3068	ItroublveTSC.exe

pid	process
3068	ItroublveTSC.exe

pid	process
2528	OneDrive.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

ItroublveTSC.exeMicrosoft OneDrive.exeOneDrive.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	ItroublveTSC.exe
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	ItroublveTSC.exe
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	ItroublveTSC.exe
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	ItroublveTSC.exe
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	Microsoft OneDrive.exe
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	Microsoft OneDrive.exe
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	Microsoft OneDrive.exe
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	Microsoft OneDrive.exe
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	schtasks.exe
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	schtasks.exe
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	schtasks.exe
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	schtasks.exe
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	OneDrive.exe
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	OneDrive.exe
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	OneDrive.exe
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	OneDrive.exe
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	powershell.exe
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	powershell.exe
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	powershell.exe
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	powershell.exe
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	schtasks.exe
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	schtasks.exe
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	schtasks.exe
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	schtasks.exe
PID 2528 wrote to memory of 312	2528	OneDrive.exe	cmd.exe
PID 2528 wrote to memory of 312	2528	OneDrive.exe	cmd.exe
PID 2528 wrote to memory of 312	2528	OneDrive.exe	cmd.exe
PID 2528 wrote to memory of 312	2528	OneDrive.exe	cmd.exe
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	WerFault.exe
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	WerFault.exe
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	WerFault.exe
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	WerFault.exe
PID 312 wrote to memory of 2564	312	cmd.exe	chcp.com
PID 312 wrote to memory of 2564	312	cmd.exe	chcp.com
PID 312 wrote to memory of 2564	312	cmd.exe	chcp.com
PID 312 wrote to memory of 2564	312	cmd.exe	chcp.com
PID 312 wrote to memory of 924	312	cmd.exe	PING.EXE
PID 312 wrote to memory of 924	312	cmd.exe	PING.EXE
PID 312 wrote to memory of 924	312	cmd.exe	PING.EXE
PID 312 wrote to memory of 924	312	cmd.exe	PING.EXE
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	cmd.exe
PID 2064 wrote to memory of 596	2064	cmd.exe	cmd.exe
PID 2064 wrote to memory of 596	2064	cmd.exe	cmd.exe
PID 2064 wrote to memory of 596	2064	cmd.exe	cmd.exe
PID 2064 wrote to memory of 596	2064	cmd.exe	cmd.exe
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	cmd.exe
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	cmd.exe
PID 1272 wrote to memory of 1496	1272	cmd.exe	chcp.com
PID 1272 wrote to memory of 1496	1272	cmd.exe	chcp.com
PID 1272 wrote to memory of 1496	1272	cmd.exe	chcp.com
PID 1272 wrote to memory of 1496	1272	cmd.exe	chcp.com
PID 1272 wrote to memory of 552	1272	cmd.exe	PING.EXE
PID 1272 wrote to memory of 552	1272	cmd.exe	PING.EXE
PID 1272 wrote to memory of 552	1272	cmd.exe	PING.EXE
PID 1272 wrote to memory of 552	1272	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\ItroublveTSC.exe
"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\ItroublveTSC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe
  "C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2460
- - C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe
    "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\klBjzeYUceSa.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:312
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1440
      4⤵
      Loads dropped DLL
      Program crash
      PID:1684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      Deletes itself
      PID:596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ubh8bZ2xxsQD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C65.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ubh8bZ2xxsQD.bat

Filesize
215B

MD5
b8d69eb824525d4323b0aeae11666c87

SHA1
67d93a9655e336885906fa680c35b5d5f5418b9d

SHA256
f34294e1881077106be42010321b74b94fdd9e17e50aee9f0adb84e618ca9d23

SHA512
cb19594c8243d7b08d55a6d9cc23518cffc66b0f42e2892ddaea444a8cc131a67bedf942904bc816d363ee1d11c1fcd3208d6a3971e78258db2585e379979278

Download Submit
C:\Users\Admin\AppData\Local\Temp\klBjzeYUceSa.bat

Filesize
211B

MD5
672056a69a3e11379d4aa4d1ae863604

SHA1
f888ede81eca74b72ffcd6ce7ff96202d3f15ca2

SHA256
6cc55d2f02f197c676946bc87efa9cd81d504a552beb8b4b901c364493af8c30

SHA512
47b737d6f7fb8fc0eb81a61f10f33fb823c630bd7bf43a2a7367f71c919e1117a34c5803a2ed2ae06a440f8548ee3de0811ed7b32c9dfc2f51fe670ff6df0bb6

Download Submit
C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe

Filesize
3.9MB

MD5
53f43b1e9d99d6a356a332d9073b4736

SHA1
71e6c5a216a66b2b523b1b022d44c10b276c6195

SHA256
584bf67e7c8e93629e175733fe42907e60916047e68f1b4973d4cbf3dd2c22d6

SHA512
e7c5e4b26309e38dd1dd52b4f509c94fb9f50453e4d5c2ba895b02c48457a15c384866fdeb57185b628f10873ed6a6e6936ad170827f4855c9c5eca15ab8f959

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe

Filesize
550KB

MD5
3fce051fde9fbd1302b4ee16f604553b

SHA1
e137d2e6fa0007ddd0bf3a1215a68b37ef2ed653

SHA256
a34954a87d0f4354a21e40ea0e9a9eee4420f47987d40be854ea7b98d6d36226

SHA512
cb07f753043b7705b0e32bbf4e1ae8ddf6176851562dea567e75a4715b1beb4031d35a43b6bf0bc45d5b2da7430be0d87b6ae61b5b2e07c7c8950bb0247e4a5c

Download Submit
memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp

Filesize
576KB

Download
memory/2528-32-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/2528-31-0x0000000072A40000-0x000000007312E000-memory.dmp

Filesize
6.9MB

Download
memory/2556-121-0x0000000072A40000-0x000000007312E000-memory.dmp

Filesize
6.9MB

Download
memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp

Filesize
576KB

Download
memory/2556-20-0x0000000072A40000-0x000000007312E000-memory.dmp

Filesize
6.9MB

Download
memory/2556-22-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2864-38-0x0000000002C50000-0x0000000002C90000-memory.dmp

Filesize
256KB

Download
memory/2864-35-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Filesize
5.7MB

Download
memory/2864-36-0x0000000002C50000-0x0000000002C90000-memory.dmp

Filesize
256KB

Download
memory/2864-37-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Filesize
5.7MB

Download
memory/2864-39-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-0-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2940-17-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2940-2-0x0000000000C50000-0x0000000000C90000-memory.dmp

Filesize
256KB

Download
memory/2940-1-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/3068-23-0x0000000000980000-0x00000000009C0000-memory.dmp

Filesize
256KB

Download
memory/3068-21-0x0000000072A40000-0x000000007312E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-19-0x0000000000D10000-0x00000000010F6000-memory.dmp

Filesize
3.9MB

Download