Overview

overview

7

Static

static

1

slitheris_...er.exe

windows7-x64

7

slitheris_...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 06:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    slitheris_installer.exe

  • Size

    7.5MB

  • MD5

    04f6dade94b26b39a62a96d51a37e127

  • SHA1

    12832e117c24728f983ba5dce474262d03cef66f

  • SHA256

    af031905bb25bfe31a522056cf45d00d52cb79d5e0b05a3d318a966099f3ab77

  • SHA512

    df8e3f691c60e5deeee7523f577a61d976b9f5e87af7f9359ca4a1ae44800725ebc94057bdda161b14f84f1b8ec02214feaf3bf6a16b942a056172349890aa6d

  • SSDEEP

    196608:MCjDh10L/+LWcjetcGbieXBL5mpeDnHvCVQjW4:HJSb+iKGbpmpCnPGQH

Score
7/10
discoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 32 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\slitheris_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\slitheris_installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Users\Admin\AppData\Local\Temp\is-DMDDC.tmp\slitheris_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DMDDC.tmp\slitheris_installer.tmp" /SL5="$120032,6946262,876032,C:\Users\Admin\AppData\Local\Temp\slitheris_installer.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\msvbvm60.dll"
        3⤵
        • Modifies registry class
        PID:216
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\COMCTL32.OCX"
        3⤵
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1860
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\cNewMenu6.dll"
        3⤵
        • Loads dropped DLL
        PID:760
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\iGrid700_10Tec.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1056
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Codejock.ChartPro.v15.1.3.0908.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:8
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\SSubTmr6.dll"
        3⤵
        • Loads dropped DLL
        PID:1884
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vbalIml240_10Tec.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2188
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vbalSbar6.ocx"
        3⤵
        • Loads dropped DLL
        PID:5056
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vbalTbar6.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3852
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\ThreadFactoryOCX_RUNTIME.ocx"
        3⤵
        • Loads dropped DLL
        PID:4188
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\ThreadFactoryLib_RUNTIME.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3444
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vbRichClient5.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3560
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3572
      • C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.exe
        "C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Komodo Labs\Slitheris\IL16.il
    Filesize

    519KB

    MD5

    73c71da668e17fc1b0498537533c26d2

    SHA1

    4fc4c70dcbc3c132bdf8bf6547c16805ae7fd71c

    SHA256

    f446cbbcb610a0ad8d1e533213a59540bc6005ad79d0f6e59ded05bf116674f3

    SHA512

    cd50be22e922d2efce05446c305f36f265c10120a73fb9647771facc1179a574d61ed44fd5ff54f84d6046816dc7f897ac9141a94e67cee3f42bc9b3b7a8220b

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\IL24.il
    Filesize

    37KB

    MD5

    c456dac11bc04e33b8fdff4ec5f205ce

    SHA1

    b47dc77cdc99720a459e70a3ffdd9ef388a94f80

    SHA256

    127ac9ebe860baeacb020e2b7c872f0dd16727e6bb84fc77862d0c6289fc76bc

    SHA512

    cb45994fb02935833b999d2c96b6c7fd011419f4df2db060d04e8394d8161dde9972eaa60c0218672aaf16a7ba6cfb5f3869118df40affdc2f768cc766a95932

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\IL32.il
    Filesize

    42.9MB

    MD5

    1d9199e4f22bda92ea253b8f9d116a19

    SHA1

    8b8dedba96efcad94c4c297fbe7df29927aba323

    SHA256

    4ba4c69de7387cab3f783d0fcfa0d761bd8f2e200b21a86aaeb7f2c1a5e7b76f

    SHA512

    dc56f7910919f5eb72785509d442c75fd949a876232c52c354d508ed682654420312bc1fb06871f1eb0e6b6841027a2f269aaa83cae6463697fe92e1f4a85092

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\COMCTL32.OCX
    Filesize

    600KB

    MD5

    fc9fef25cd6620d5691375f392b0fdc8

    SHA1

    fdddec932d2842d94459e86212e17a88f9ce2c77

    SHA256

    4f97aa44d3f5ecab907908d44a2cccd73ad67193fc10084ee1ba01577d9ad384

    SHA512

    c2f3907d20efe2f71c7d5cd43d84f631a1adef4664c2de7b802ce2b766417906a22e534d771b29d6b29c6889f6045bcdfe91269a093c9a5af859c97c4f3ce137

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\Codejock.ChartPro.v15.1.3.0908.ocx
    Filesize

    1.2MB

    MD5

    4eeb2b0ace3849d7714f782aa5ea687b

    SHA1

    947fd7bcbb0e15f92562cead861163a07e227316

    SHA256

    c279bae9525dcd4708d6ba7284c1a00c1081834ec9a97837ded435e0fbdd6ea6

    SHA512

    89d0bd04acaf127fbb8ed749fca2915e03cd8fa70d6ae47b8f074dc71c3914540849af3f3c11c302a45cca0bd9f777d9bc12eb5b4a3ca6fc9da9e97fc6eb9824

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\SSubTmr6.dll
    Filesize

    40KB

    MD5

    dc7a3bc0fc185cd68848dc6f7d7b026b

    SHA1

    c661cb1198f5e3927a67884e71ca95ff33026224

    SHA256

    6618b3ab331642449f0b07e4f39abf9fc3bb90ae90b298f1b9ffd58ca5397399

    SHA512

    22c9b2b7930e9e442699e37f43944f7cb4cd2562ed8319b4341c59475fa8071b501f4908227378b7883930f14c3059f66531bf876b386dea0027151b08006577

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\ThreadFactoryLib_RUNTIME.dll
    Filesize

    236KB

    MD5

    78553ebfaa9dbeed86d36cada603dd28

    SHA1

    8116289100f08644433a8287048b1dc173f19651

    SHA256

    6f785af3c555e69be6b862ce9e7073adc060e5b940808d63b1aed142b50352fd

    SHA512

    3eaa60beb40a3c2181cdf61df651b6bde29ed187fe5083ebeacf9d7c406bb0e8a727b5493b64921276c9951ccf66d005c1591c84755bbf46402500a81643bf69

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\ThreadFactoryOCX_RUNTIME.ocx
    Filesize

    168KB

    MD5

    f20177009cb6681e6a98270527f4d781

    SHA1

    d7b48256530bcdfe6c39ea0a56d644f437d6d9cf

    SHA256

    eaae5e67e234944c588ef4ae17fdf7aad06a924e04bf8804decb43484e38e37e

    SHA512

    474a383ed666ded0c2d74b5e58e653a2f2cdede31873e9732ed27fd9fd719df3dc415c9ffd0eb5fb9d5cf28bb915df6e1b42d8ba8249ae2c026d0e0e17cc7c37

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\cNewMenu6.dll
    Filesize

    156KB

    MD5

    0a096566e80eab85c466a3f260d0d2fe

    SHA1

    517abbe0d2c2311e84ed5a9ecea7d0f00656eb25

    SHA256

    d8097ac6080f06779f6d6ee48c2ae79882d562f66bd3de18afe6bd84a5783004

    SHA512

    f0bbaa449e33adea49163665935ba7d8bb9e0255690b6b65e9c77a2cdaece53643b9943ba342c6fff4404afab862bd48d3b5f86bd61b1dfb7d98d6213bae0b82

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\iGrid700_10Tec.ocx
    Filesize

    918KB

    MD5

    2bf7311a50ff74525b69f360018fe245

    SHA1

    957a5675ae31082a2d0af04d2fbd2df6ff29d429

    SHA256

    3195717080dcd458068d3253d20935a12173e6ecb171b74cb3aa4d05f139f8b6

    SHA512

    b3f061797e26ec9dc42c3a04523a6b3ec98311ab9f2bb5b7260515d9e43ddf4e35c741ed2dc80335dc7922b1ee712f4c7585fe323495353ac52b0c20ca359a9b

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\is-9IUSV.tmp
    Filesize

    2.5MB

    MD5

    4af8e37c0fe4ff8d19927e708816d474

    SHA1

    6cacf3eb3159535239abd9d7d7fd787f3a0966d5

    SHA256

    a450d8204ab794fd00ace8539e7b828e4a2e85d4731f54edee4a82a269b15801

    SHA512

    b7ac820af2978216d975b8db681172f12ba8e354a0da93c2f9075ed219ba2516a62adb4d658adf9f390812b40a2c29f352b246563cc8a2410631c648ea21408b

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\vbRichClient5.dll
    Filesize

    3.7MB

    MD5

    92c39b92040ad9c88af3fe70bf0abff5

    SHA1

    866a3af0e503bdc1a9e13d7ebfee08f43a690dd5

    SHA256

    5d4e60ceb742a6c53855c2c2c80c960a788109881d6a2d4948b38a488862ce6a

    SHA512

    0b1ffab958735bcc2fb4d42aab4f7158faeb723c6286cd4050a3fca01ae7c25f62d18f975d17badf0b7aacc645c7117e28992870fb0eb0b6fe59523da4537f97

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\vbalIml240_10Tec.ocx
    Filesize

    136KB

    MD5

    f8df78f319736723c2551e781b2562d4

    SHA1

    0ea470ffe6da1520320b073fe42e6dc500359ff0

    SHA256

    2aa5262d0fbb8ad08e3b0913ebe65b39e9d7f142102536b94ea6c056345a785e

    SHA512

    e7a406314d0fc3ed1e84ccfb08a81a7520bc6030c4e815bba61b4074157fd170e0f4ef2d82eac4dc65b4baed11185407b672866f538b87e54868d24de33e7efb

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\vbalSbar6.ocx
    Filesize

    56KB

    MD5

    f2a60642c8c2f180da8ebeac3e089334

    SHA1

    d449a76765887bb3bbc2cda641087a048d5d37d1

    SHA256

    9018b1ccd2a67cba1c5fb93e868240473d53e7b9fa2b5e31d17a66c9b325c4e2

    SHA512

    7607e6d4885b0571e6c7f816cc24b10e5c403aaf8143190ab6a83464aea7041e5e98160454a161f7cd6985b6cb4b6b266f0a04b7acb65448fd82606095fcd2b4

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Portable\Components\vbalTbar6.ocx
    Filesize

    364KB

    MD5

    93968a328cbc6495860f9ae1c9f5ee71

    SHA1

    98ea43ec154d5a7344888ec72babee5b2fe7142b

    SHA256

    35e6c9095fb07b5b45d5c3b1ff9a335ed2df3db38ce8f9d4cb7a3b081caab404

    SHA512

    05c543dabab48ad964a312aeb67e14b72472ab662e9ce30af49e6d210c423ec20ff372467ef78b5772eb12b350cbfde11e19baaa8711ca9aa98f9b0120db2392

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.cfg
    Filesize

    583B

    MD5

    fa981bce7a31a65a5025f4aa78abb87e

    SHA1

    961fee76f84455de110e05d6645a8e10bab17298

    SHA256

    f0369961acafed9e30252e688f873cf767e4c4b0bb4faeb3c098a4be96ebe7a6

    SHA512

    6b08e3abc258d8700a3489a3ada7cf7809f50ebb05ea7f3e8454287f63f19297d992a518b35ad224cdcda3d3481f448dbe6b51727688aaa1ed04acc071ab788a

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.dll
    Filesize

    438KB

    MD5

    5afd55df4d7962cd0dc79149feef7bc2

    SHA1

    f55805fe197907c121013e02a924e9c9f5bacc48

    SHA256

    5dd00c80477d0cd0feff6d49a71b0cf1c50847f58a5c0eef8adb88dc4f6d5762

    SHA512

    3afd52aad5cd8c24177060f335c3a01f685e84d0f71db34c48e71e745c18758d0b5e8c54bdea6f0f14e085941f2b1c92b2da716b405864d7a4db6eb770ced3de

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\Slitheris.exe
    Filesize

    841KB

    MD5

    3b814b7f43e1bf1bb55d09159a1ae85f

    SHA1

    ec27002b647c965577e1eef42a1a37a8679c3c6f

    SHA256

    fff2511a3479dc9c07ae18d44928e5789a478b1cf96638a9a47e6faf07eaf782

    SHA512

    9f370f73e02a9d48c6b2b7dcfe8464094a7419ec48b16384e81ba7db73eb5a44de9461e98919f16545fd22f89448bc4c362a15c7928ea2edbf72c77d9a9e4f25

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\SlitherisDetect.dat
    Filesize

    344B

    MD5

    7b5d735e9303aa72a083ab18bb7c935e

    SHA1

    bd510db065670bef723c24292df0b9ebe47560bf

    SHA256

    75e0964e8d343fe1b6dcaf7904619f9660f3204c7d14d4d7a68b8efe0321b0b2

    SHA512

    fa6bc9020b6373844fab779f77bc4f849c23ca408703db00affc11a4e288123de94852f42138b1d16e2811a89f4a1ebe0199e1bb0a83d7f294b0bed7de60de02

    Download Submit

  • C:\Program Files (x86)\Komodo Labs\Slitheris\SlitherisDetect.mdb
    Filesize

    5.6MB

    MD5

    29a79ab4f77d33bc7597fe966f530e53

    SHA1

    4bafd0cb7a297dd69fa9d7612c5110e6d844ed31

    SHA256

    4bef4d49c0b8c58437932a1c04fa28350257656d31b02c31eb58420fd870d010

    SHA512

    57a2658650184feac970206e78169e3c5ec30d935a5ecbe60fe0739b8f860054a938c66af579f6252cdc9380545928933dbca25ab1ff0e5aaf729c3e1b7e2cd2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-DMDDC.tmp\slitheris_installer.tmp
    Filesize

    3.1MB

    MD5

    b43d853e5756b57ab6343dc87dec1ab6

    SHA1

    f650c16f7d98fd5ce153294dcd5b21cd866956af

    SHA256

    3c3a08aefde2193b047846dcf244c8139270c9738e80c7b652386b8c34d586cc

    SHA512

    95fa7036adbcd2f940d5370695ae49e9c8090facc3888327729350b0a2371ca099c56ee4720554f5fcecdf14cb1191d622400c30c7d33cd634ad5fec63e4ab4f

    Download Submit

  • C:\Windows\SysWOW64\DirectCOM.dll
    Filesize

    23KB

    MD5

    f9cad96ec2e655d19d474160c7c53485

    SHA1

    3cbfc63d55c695f2aafb2add276fe60da968d952

    SHA256

    f7fef855fdf9dac44fd23b06d1c7ecbe4142f11aaa5d68a3c91c578bdc64df05

    SHA512

    9d6f379c873ed8028cfae606f31536495babdd3224682cf200864b5c7b493d69b7604978e8882872340a7a64ab21f141fb4ee9bb63843400bf68ed58a6c6b3b3

    Download Submit

  • memory/1692-6-0x0000000000400000-0x000000000071F000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1692-137-0x0000000000400000-0x000000000071F000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1692-143-0x0000000000400000-0x000000000071F000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1692-9-0x0000000000400000-0x000000000071F000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1692-163-0x0000000000400000-0x000000000071F000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2084-145-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-195-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-157-0x0000000003BF0000-0x0000000003C2C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2084-226-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-170-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-212-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-213-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-175-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-174-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-176-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-178-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-180-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-181-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-188-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2084-187-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2084-194-0x0000000000400000-0x0000000000A6C000-memory.dmp

    Filesize

    6.4MB

    Download

  • memory/2404-164-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

    Download

  • memory/2404-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

    Download

  • memory/2404-8-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

    Download

  • memory/2404-0-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

    Download

  • memory/3572-138-0x0000000034240000-0x00000000343DF000-memory.dmp

    Filesize

    1.6MB

    Download