dcrat | 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25

Analysis

max time kernel
30s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
16/05/2024, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XNXBot Test v5.exe
Size 2.6MB
Sample240516-1erm8she46
SHA256 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25
MD5 3a6417ba5ef68d3d1823cda12878d367
SHA1 216a748dd2756ad28960a79775b3e13fcf0eed5f
SHA512 819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668
SSDEEP 49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\", \"C:\\comsurrogateServercommon\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Speech_OneCore\\services.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\", \"C:\\comsurrogateServercommon\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Speech_OneCore\\services.exe\", \"C:\\Users\\All Users\\Desktop\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\lsass.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\", \"C:\\comsurrogateServercommon\\StartMenuExperienceHost.exe\""	mscomAgent.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	5036	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	5036	schtasks.exe	81

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/files/0x000200000002a9fc-10.dat	dcrat
behavioral4/memory/1256-13-0x0000000000F40000-0x0000000001190000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1256	mscomAgent.exe
1820	services.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\comsurrogateServercommon\\StartMenuExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\comsurrogateServercommon\\StartMenuExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Speech_OneCore\\services.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Videos\\lsass.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\mscomAgent = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscomAgent = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\mscomAgent.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Desktop\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Videos\\lsass.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Speech_OneCore\\services.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Desktop\\System.exe\""	mscomAgent.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\mscomAgent.exe	mscomAgent.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\c7fcea9e23478b	mscomAgent.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\csrss.exe	mscomAgent.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\services.exe	mscomAgent.exe
File created	C:\Windows\Speech_OneCore\c5b4cb5e9653cc	mscomAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
388	schtasks.exe
3428	schtasks.exe
1600	schtasks.exe
2024	schtasks.exe
4632	schtasks.exe
4936	schtasks.exe
2632	schtasks.exe
3456	schtasks.exe
488	schtasks.exe
4072	schtasks.exe
3900	schtasks.exe
2340	schtasks.exe
4164	schtasks.exe
4536	schtasks.exe
4688	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	XNXBot Test v5.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	mscomAgent.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1256	mscomAgent.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe
1820	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	mscomAgent.exe
Token: SeDebugPrivilege	1820	services.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	services.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3184	3040	XNXBot Test v5.exe	77
PID 3040 wrote to memory of 3184	3040	XNXBot Test v5.exe	77
PID 3040 wrote to memory of 3184	3040	XNXBot Test v5.exe	77
PID 3184 wrote to memory of 1852	3184	WScript.exe	78
PID 3184 wrote to memory of 1852	3184	WScript.exe	78
PID 3184 wrote to memory of 1852	3184	WScript.exe	78
PID 1852 wrote to memory of 1256	1852	cmd.exe	80
PID 1852 wrote to memory of 1256	1852	cmd.exe	80
PID 1256 wrote to memory of 2484	1256	mscomAgent.exe	97
PID 1256 wrote to memory of 2484	1256	mscomAgent.exe	97
PID 2484 wrote to memory of 2344	2484	cmd.exe	99
PID 2484 wrote to memory of 2344	2484	cmd.exe	99
PID 2484 wrote to memory of 1820	2484	cmd.exe	101
PID 2484 wrote to memory of 1820	2484	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe
"C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\comsurrogateServercommon\BU5c99cqg2jzc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\comsurrogateServercommon\mscomAgent.exe
      "C:\comsurrogateServercommon\mscomAgent.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l2HJFN91K7.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2344
      - C:\Windows\Speech_OneCore\services.exe
        
        "C:\Windows\Speech_OneCore\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Videos\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomAgentm" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\mscomAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomAgent" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\mscomAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomAgentm" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\mscomAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\comsurrogateServercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\comsurrogateServercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\comsurrogateServercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

l2HJFN91K7.bat

Path C:\Users\Admin\AppData\Local\Temp\l2HJFN91K7.bat
Size 203B
SHA256 7c59d862e8ce739d43bde5321a9b3e6143ad15996e264b38afa10e4d21d10792
MD5 153725bbe841b0968ff0f8e03bc438a4
SHA1 8ece492b8b82ee22850a350e6311071f1be2a481
SHA512 1749e3ad69705e81e636cfe6ec9801b89b0dba763eb9b04205e17f48e8e090a7be1e3b9bd9f3dab322ff37879a2db6758f56251c0620b8121d8a995a2d4f3077
MD5 SHA1 SHA512

Submit Download

BU5c99cqg2jzc.bat

Path C:\comsurrogateServercommon\BU5c99cqg2jzc.bat
Size 55B
SHA256 d7105ee692b694f449108c533bd361b5d7d6a41602acb5f9daaa611800a4119d
MD5 d8c1badb2510bbf4488af2000fa47899
SHA1 34ff8a3367ffc6d3320ccf3dc4e5e602aacb4194
SHA512 0de83b211d2c4f450e5ff041b1b2f1c363151dd2abb990821bb3277c543ae5ad6977a4897210a79114920d1d52da26522e3aeced146c1487b9ad76b925a8288b
MD5 SHA1 SHA512

Submit Download

mscomAgent.exe

Path C:\comsurrogateServercommon\mscomAgent.exe
Size 2.3MB
SHA256 8ed97cc29cf906767eeafc2f01ae853688add73580061c50b96235babb545f24
MD5 9a7f8bce21abf6d5931d00fd9f86be17
SHA1 30c3453cfb6242c81ef040c6f4f2d4dccd4c2eb0
SHA512 69c1e4bb02ad477c619e58556372ca34945ee3813642cf2698f5bb492e7f2cf42eb424e088172621ced657f975a3c0af89022a0f0a91a46795d97697632c2651
SSDEEP 49152:g6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1Bf:rn/V89ITPTnK1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe

Path C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe
Size 225B
SHA256 0467ec4409e7abe4c793aa799094039859c212506a20d7ff78a5283697fbbc75
MD5 464eb5fbd1d2388aa6f3d2aaec4a9309
SHA1 41e7d16bef980098f8c9e785d65d2a545993bb8e
SHA512 997966240818cb172d0fe4a1701593882b74ab18031095c7dccd8b449d8637c2e631138591375cb16fc31a4ffd50e5131d7724e76a08e4e7c68de2a40ca63bcd
MD5 SHA1 SHA512

Submit Download

memory/1256-19-0x000000001CA70000-0x000000001CF98000-memory.dmp

Download

memory/1256-21-0x000000001C540000-0x000000001C548000-memory.dmp

Download

memory/1256-17-0x000000001C4F0000-0x000000001C546000-memory.dmp

Download

memory/1256-16-0x000000001C450000-0x000000001C466000-memory.dmp

Download

memory/1256-15-0x000000001C4A0000-0x000000001C4F0000-memory.dmp

Download

memory/1256-18-0x0000000003290000-0x00000000032A2000-memory.dmp

Download

memory/1256-13-0x0000000000F40000-0x0000000001190000-memory.dmp

Download

memory/1256-14-0x000000001C430000-0x000000001C44C000-memory.dmp

Download

memory/1256-20-0x000000001C490000-0x000000001C49E000-memory.dmp

Download

memory/1256-12-0x00007FFD124B3000-0x00007FFD124B5000-memory.dmp

Download

memory/1820-41-0x000000001C980000-0x000000001C992000-memory.dmp

Download

memory/1820-43-0x000000001D160000-0x000000001D169000-memory.dmp

Download

memory/1820-44-0x000000001E010000-0x000000001E01D000-memory.dmp

Download

memory/1820-46-0x000000001E040000-0x000000001E04B000-memory.dmp

Download

memory/1820-45-0x000000001E020000-0x000000001E03E000-memory.dmp

Download

memory/1820-42-0x000000001DDB0000-0x000000001DDF6000-memory.dmp

Download