rook | a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e

General

Target

a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
Size

126KB
MD5

84134031ba193cf5cc6da995ce298cd2
SHA1

e955ce1fa9b31084c822cc641f49a28859b82371
SHA256

a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e
SHA512

cab52649cb176c160efccb21b8a3c3f16311ba30e25c86e1c6878a84fe4a60c9d1073f2df673c05823145fb27fb0879703bd8c8daaeac13ff310e39d3c5f3c6f
SSDEEP

3072:BNEp/EAS/mhYugM7vewJ8oJno9Xxh+tuk0oFaWJxT6XyzJ53Lnhdgddz5:nEpBduutSwJ8oJn8X+turkJ/6Xy57hS1

Score

10^/10

rook ransomware

Malware Config

Extracted

Path

C:\Program Files\!nissenvelten!HOW_TO_RESTORE.log

Family

rook

Ransom Note

Hello! We warned you, but you even didn't replied Forced shutdown of devices can lead to the loss of all data. Do not forcibly disconnect storage volumes from hosts, don't interrupt process. Damaged information cannot be recovered. All data is properly protected against unauthorized access by steady encryption technology. We have downloaded essential data of company: - Huge amount of files, including: HR,Financial,Accounting,... - Large amounts of personal records of your employees and residents. - about 1TB (!!!) of data! In case if you refuse to cooperate with us, all essential data will be sold or published at dark marketplace. Full details and proofs will be provided in case of contacting us by following emails. [email protected] [email protected] It's just a business. We can help you to quickly recover all your files. We will explain what kind of vulnerability was used to hack your network. If you will not cooperate with us, you will never know how your network was compromised. We guarantee this will happen again. We can decrypt 2 small files (up to 1MB) for free. Send files by email. Register new email account at secure mail service like mailfence, protonmail to be sure that outgoing email not blocked by spam filter. Don't use gmail! WARNING! Don't report to police. They will suspend financial activity of company and negotiation process. �

Emails

[email protected]

Signatures

Rook
Rook is a ransomware which copies from NightSky ransomware.
ransomware rook
Renames multiple (6930) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\eu.pak.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\da_get.svg.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ms.pak.DATA.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\fr.pak.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedgewebview2.exe.sig.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-114x114-precomposed.png.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\en-GB.pak.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\!nissenvelten!HOW_TO_RESTORE.log	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js.nissenvelten-sjj3hhut	a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe

C:\Users\Admin\AppData\Local\Temp\a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe
"C:\Users\Admin\AppData\Local\Temp\a9238bb7a0c565768ab6478114704dce98c161e82d9f8b59b5989f7a5d1d189e.exe"
1⤵
- Drops file in Program Files directory
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.nissenvelten-sjj3hhut

Filesize
2KB

MD5
e600823c746e6925b136cc3cdda01fd5

SHA1
9b62121e2ca40792452628b6fa33eff90d6d928a

SHA256
fbb1d85b52fd4a30f7f172220bffa1be2b4ee46a40f95cf99fd92184673e6ce6

SHA512
dbc1bb315de1e015eed371c3e79d1327da82dd477080b2ae11441ec0afc3b2c3136594da6b7dd7e9c5807ab84eabe7eb9cded4a67c6cbd1f18a0e563c80d2e65

Download Submit
C:\Program Files\!nissenvelten!HOW_TO_RESTORE.log

Filesize
1KB

MD5
1ac13e1c2b35dfaf377ceb55e61e5309

SHA1
e53185eee04a0578483054e507d639be2635b4d7

SHA256
72e9a50a52585a25c5529b846cf586946694e46a912a97b526e4a7067ab1d7e6

SHA512
fa702569f13d82d24e78cba21397f0d53281c0a93db7a484bb974f4cb965da23dd4691c7061de6bfd54e40d5d32faa2e8b8af52968191b91f9164f5c7d459fa6

Download Submit
memory/1616-0-0x0000000000290000-0x00000000002E2000-memory.dmp

Filesize
328KB

Download
memory/1616-3-0x0000000000DA0000-0x0000000000DB9000-memory.dmp

Filesize
100KB

Download
memory/1616-1176-0x0000000000DA0000-0x0000000000DB9000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing