7d78d20fe815437d47581a063d61ad4c37f19d8d72a9abc6ab657a70e06cd306

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00b7a0aba98606fdb9a65150b127c7bc.exe
Size

104KB
MD5

00b7a0aba98606fdb9a65150b127c7bc
SHA1

98f96d187c7878d25e484eb8434414c140c2c0cf
SHA256

7d78d20fe815437d47581a063d61ad4c37f19d8d72a9abc6ab657a70e06cd306
SHA512

91189ab7dde8e8d2a7b7e124b015da7f228291fa8f7023301d8f28740b01ddbd6d3f902398ea558b57c34783379c35deac3a1e57c86cfafeab1e61974c39941e
SSDEEP

1536:bvmdO2zqJiJ6vFCHxvEu7oh2lnD7yoN6OPtjz:zmdO2vJ6S9Ebh2lnSoNPd

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\msosmsfpfis64.sys	00b7a0aba98606fdb9a65150b127c7bc.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1940	00b7a0aba98606fdb9a65150b127c7bc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msosptfs00.dll	00b7a0aba98606fdb9a65150b127c7bc.exe
File opened for modification	C:\Windows\SysWOW64\msosptfs00.dll	00b7a0aba98606fdb9a65150b127c7bc.exe
File opened for modification	C:\Windows\SysWOW64\msosptfs.dat	00b7a0aba98606fdb9a65150b127c7bc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	00b7a0aba98606fdb9a65150b127c7bc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1940	00b7a0aba98606fdb9a65150b127c7bc.exe
1940	00b7a0aba98606fdb9a65150b127c7bc.exe
1940	00b7a0aba98606fdb9a65150b127c7bc.exe
1940	00b7a0aba98606fdb9a65150b127c7bc.exe
1940	00b7a0aba98606fdb9a65150b127c7bc.exe
1940	00b7a0aba98606fdb9a65150b127c7bc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	00b7a0aba98606fdb9a65150b127c7bc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 620	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	10
PID 1940 wrote to memory of 672	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	1
PID 1940 wrote to memory of 784	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	2
PID 1940 wrote to memory of 792	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	9
PID 1940 wrote to memory of 800	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	8
PID 1940 wrote to memory of 900	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	7
PID 1940 wrote to memory of 960	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	4
PID 1940 wrote to memory of 388	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	6
PID 1940 wrote to memory of 472	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	5
PID 1940 wrote to memory of 60	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	93
PID 1940 wrote to memory of 704	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	92
PID 1940 wrote to memory of 1036	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	91
PID 1940 wrote to memory of 1080	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	90
PID 1940 wrote to memory of 1180	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	89
PID 1940 wrote to memory of 1260	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	88
PID 1940 wrote to memory of 1280	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	87
PID 1940 wrote to memory of 1344	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	86
PID 1940 wrote to memory of 1352	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	85
PID 1940 wrote to memory of 1360	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	84
PID 1940 wrote to memory of 1384	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	83
PID 1940 wrote to memory of 1404	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	82
PID 1940 wrote to memory of 1540	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	81
PID 1940 wrote to memory of 1556	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	80
PID 1940 wrote to memory of 1664	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	79
PID 1940 wrote to memory of 1672	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	78
PID 1940 wrote to memory of 1716	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	77
PID 1940 wrote to memory of 1800	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	76
PID 1940 wrote to memory of 1808	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	75
PID 1940 wrote to memory of 1932	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	74
PID 1940 wrote to memory of 1952	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	73
PID 1940 wrote to memory of 1988	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	72
PID 1940 wrote to memory of 1288	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	71
PID 1940 wrote to memory of 2136	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	70
PID 1940 wrote to memory of 2188	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	69
PID 1940 wrote to memory of 2212	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	68
PID 1940 wrote to memory of 2288	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	67
PID 1940 wrote to memory of 2296	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	66
PID 1940 wrote to memory of 2500	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	65
PID 1940 wrote to memory of 2516	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	64
PID 1940 wrote to memory of 2532	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	63
PID 1940 wrote to memory of 2576	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	62
PID 1940 wrote to memory of 2764	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	61
PID 1940 wrote to memory of 2772	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	60
PID 1940 wrote to memory of 2820	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	59
PID 1940 wrote to memory of 2836	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	58
PID 1940 wrote to memory of 2860	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	57
PID 1940 wrote to memory of 2880	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	56
PID 1940 wrote to memory of 2888	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	55
PID 1940 wrote to memory of 3128	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	54
PID 1940 wrote to memory of 3420	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	52
PID 1940 wrote to memory of 3560	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	51
PID 1940 wrote to memory of 3712	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	50
PID 1940 wrote to memory of 3908	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	49
PID 1940 wrote to memory of 4000	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	48
PID 1940 wrote to memory of 4064	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	47
PID 1940 wrote to memory of 2804	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	46
PID 1940 wrote to memory of 2744	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	45
PID 1940 wrote to memory of 4608	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	41
PID 1940 wrote to memory of 4260	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	40
PID 1940 wrote to memory of 2176	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	39
PID 1940 wrote to memory of 4060	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	38
PID 1940 wrote to memory of 5116	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	37
PID 1940 wrote to memory of 4388	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	35
PID 1940 wrote to memory of 748	1940	00b7a0aba98606fdb9a65150b127c7bc.exe	34

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:472

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3140
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3508
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:1380
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1484
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1944
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3000
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:764
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4608
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2744
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:2804
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4064
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:4000
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3908
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3128

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Users\Admin\AppData\Local\Temp\00b7a0aba98606fdb9a65150b127c7bc.exe
"C:\Users\Admin\AppData\Local\Temp\00b7a0aba98606fdb9a65150b127c7bc.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\00b7a0aba98606fdb9a65150b127c7bc.exe"
  2⤵
  PID:3824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4948

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:748

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3712

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2880

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2820

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2576

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4910.tmp

Filesize
11KB

MD5
bd5a98ef6a62e1cf74d59a825c0bc01d

SHA1
fac827a57608c0a8699f393c9281ee37827e34ed

SHA256
898b56fd395e3ca6f5200f5d631181516f593509d86d9a606ef852266a87fffd

SHA512
2828440a2fc86b9b019f47170558baf4f6a0ab1ce8f9037a057376e6715e41a11b2fdccf1bd5f22b7a8435ea7c28d03107b45cab836dbf091137fd0808580e64

Download Submit
memory/620-12-0x000000001B0E0000-0x000000001B0E1000-memory.dmp

Filesize
4KB

Download
memory/1940-6-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download