Malware Analysis Report

2025-01-22 13:31

Sample ID 210216-1h7ps26lms
Target 6d0000.exe
SHA256 da767e6faf97d73997f397eae71b372a549dd6331bf8ec0ebd398ef8cfe9a47e
Tags
osiris banker botnet spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da767e6faf97d73997f397eae71b372a549dd6331bf8ec0ebd398ef8cfe9a47e

Threat Level: Known bad

The file 6d0000.exe was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet spyware

Osiris

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Uses Tor communications

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-02-16 14:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-02-16 14:19

Reported

2021-02-16 14:21

Platform

win7v20201028

Max time kernel

151s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d0000.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Reads user/profile data of web browsers

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6d0000.exe

"C:\Users\Admin\AppData\Local\Temp\6d0000.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
N/A 66.111.2.131:9030 66.111.2.131 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 50.19.96.218:443 api.ipify.org tcp
N/A 54.39.16.73:80 54.39.16.73 tcp
N/A 46.166.173.169:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 135.125.106.172:80 135.125.106.172 tcp
N/A 45.79.124.234:443 tcp
N/A 96.253.78.108:80 96.253.78.108 tcp
N/A 195.154.240.7:443 tcp
N/A 52.143.157.92:80 52.143.157.92 tcp
N/A 94.140.120.130:443 tcp
N/A 216.239.90.19:80 216.239.90.19 tcp
N/A 185.4.135.157:80 185.4.135.157 tcp
N/A 95.211.136.23:80 95.211.136.23 tcp
N/A 81.198.227.39:443 tcp
N/A 172.107.201.134:80 172.107.201.134 tcp
N/A 155.4.70.21:80 155.4.70.21 tcp
N/A 37.157.254.114:80 37.157.254.114 tcp
N/A 82.94.251.227:80 82.94.251.227 tcp
N/A 195.206.105.217:80 195.206.105.217 tcp
N/A 198.211.103.103:443 tcp
N/A 81.29.134.110:80 81.29.134.110 tcp
N/A 135.148.33.148:80 135.148.33.148 tcp
N/A 51.38.134.104:80 51.38.134.104 tcp
N/A 38.147.122.254:443 tcp
N/A 127.0.0.1:32767 tcp

Files

memory/1832-2-0x00000000765A1000-0x00000000765A3000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/1140-4-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 805c9ec4b042b2e718a167a9aab70351
SHA1 aab9f4086b284e2f561ca6d438598db348466b05
SHA256 33c8e3e2007c2060771f574cdf4b4ee9653af6ed95c4dfc5235f3ff291ea5905
SHA512 cdb8cca218f0946a1395f58233bf5be0e00f7a583a9af8a1fdb324ea285a4ad150227602ac024c3ef635b4030afe9eb9b11a5603b7efc9963ee1cb3c4a3a1952

memory/1792-7-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-02-16 14:19

Reported

2021-02-16 14:21

Platform

win10v20201028

Max time kernel

24s

Max time network

83s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d0000.exe"

Signatures

Osiris

banker botnet osiris

Reads user/profile data of web browsers

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\6d0000.exe

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6d0000.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6d0000.exe

"C:\Users\Admin\AppData\Local\Temp\6d0000.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

C:\Users\Admin\AppData\Local\Temp\{7484BCA8-33F5-4FD1-9644-6F2CDBC0E606}\2075268060.exe

"2075268060.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 1120

Network

Country Destination Domain Proto
N/A 199.58.81.140:80 199.58.81.140 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 54.225.220.115:443 api.ipify.org tcp
N/A 23.129.64.210:80 23.129.64.210 tcp
N/A 135.181.202.85:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 45.84.253.28:80 45.84.253.28 tcp
N/A 185.82.127.48:80 185.82.127.48 tcp
N/A 198.98.48.175:80 198.98.48.175 tcp
N/A 109.107.35.154:80 109.107.35.154 tcp
N/A 185.220.102.249:80 185.220.102.249 tcp
N/A 199.249.230.111:443 tcp
N/A 194.88.143.66:80 194.88.143.66 tcp
N/A 135.148.33.70:80 135.148.33.70 tcp
N/A 46.28.207.107:80 46.28.207.107 tcp
N/A 178.17.171.78:443 tcp
N/A 213.164.204.94:80 213.164.204.94 tcp
N/A 80.179.96.165:80 80.179.96.165 tcp
N/A 127.0.0.1:32767 tcp
N/A 8.8.8.8:53 www.msftconnecttest.com udp
N/A 13.107.4.52:80 www.msftconnecttest.com tcp

Files

memory/1904-2-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 a34de5c7d0026d2c3cdd4f5fdc880b14
SHA1 3848d11d05189aa78ba6d4504a0dd32d781a066f
SHA256 a936c1ad4a037d44b3711fe680235cc6bf5865a9c6bdc4e4daa22db7e855d92c
SHA512 6e5d20752f094f93b6b26f26f464750fb11ded5c4e96bc41181a60d155d0c2dcb754279540cffbad3a745a052e380745a8b41803389d8287369d76ebe1988840

C:\Users\Admin\AppData\Local\Temp\{7484BCA8-33F5-4FD1-9644-6F2CDBC0E606}\2075268060.exe

MD5 9f385a9a69a4d9e18055743f0694976b
SHA1 2c2385ea964a33f803e96e364d4a05771c733921
SHA256 45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512 e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

memory/3372-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\{7484BCA8-33F5-4FD1-9644-6F2CDBC0E606}\2075268060.exe

MD5 9f385a9a69a4d9e18055743f0694976b
SHA1 2c2385ea964a33f803e96e364d4a05771c733921
SHA256 45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512 e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

memory/380-13-0x0000000004B60000-0x0000000004B61000-memory.dmp