Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    13s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/08/2024, 19:16

General

  • Target

    bot_RAT (1).exe

  • Size

    70.3MB

  • MD5

    0398b7de1ec53614ff93de0cf73c2cbf

  • SHA1

    730ebb7a819734b88239a0c9d96e7a5556ad8981

  • SHA256

    d8f646ea55f46d2eedd074d54405a896e77563e310d43ae490eb2f971b72b36a

  • SHA512

    246ffd49d49ef79b4d7b62764e1a8fee1be72b3b4b442307632c0fe8a0074d4e5567b5471482984bbe8ea84045af2f3232ae8f80887a53000e99b761b1d8ca47

  • SSDEEP

    1572864:8RWMQoWGgFP/V4f6Gj53ikjt4jRq2GqFOPV5GiIY2qHWB75iVfaLu7/K:8UMffgt/VG6RmtCRlGPrcY2qHO5iVfaL

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 54 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bot_RAT (1).exe
    "C:\Users\Admin\AppData\Local\Temp\bot_RAT (1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Users\Admin\AppData\Local\Temp\bot_RAT (1).exe
      "C:\Users\Admin\AppData\Local\Temp\bot_RAT (1).exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      PID:4600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\VCRUNTIME140.dll

    Filesize

    116KB

    MD5

    be8dbe2dc77ebe7f88f910c61aec691a

    SHA1

    a19f08bb2b1c1de5bb61daf9f2304531321e0e40

    SHA256

    4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

    SHA512

    0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\VCRUNTIME140_1.dll

    Filesize

    48KB

    MD5

    f8dfa78045620cf8a732e67d1b1eb53d

    SHA1

    ff9a604d8c99405bfdbbf4295825d3fcbc792704

    SHA256

    a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

    SHA512

    ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_asyncio.pyd

    Filesize

    69KB

    MD5

    cc0f232f2a8a359dee29a573667e6d77

    SHA1

    d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7

    SHA256

    7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d

    SHA512

    48484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_bz2.pyd

    Filesize

    83KB

    MD5

    dd26ed92888de9c57660a7ad631bb916

    SHA1

    77d479d44d9e04f0a1355569332233459b69a154

    SHA256

    324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

    SHA512

    d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_cffi_backend.cp312-win_amd64.pyd

    Filesize

    178KB

    MD5

    0572b13646141d0b1a5718e35549577c

    SHA1

    eeb40363c1f456c1c612d3c7e4923210eae4cdf7

    SHA256

    d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7

    SHA512

    67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_ctypes.pyd

    Filesize

    122KB

    MD5

    c8afa1ebb28828e1115c110313d2a810

    SHA1

    1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a

    SHA256

    8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0

    SHA512

    4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_decimal.pyd

    Filesize

    251KB

    MD5

    cea3b419c7ca87140a157629c6dbd299

    SHA1

    7dbff775235b1937b150ae70302b3208833dc9be

    SHA256

    95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

    SHA512

    6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_hashlib.pyd

    Filesize

    64KB

    MD5

    d19cb5ca144ae1fd29b6395b0225cf40

    SHA1

    5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

    SHA256

    f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

    SHA512

    9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_lzma.pyd

    Filesize

    156KB

    MD5

    8cfbafe65d6e38dde8e2e8006b66bb3e

    SHA1

    cb63addd102e47c777d55753c00c29c547e2243c

    SHA256

    6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

    SHA512

    fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_multiprocessing.pyd

    Filesize

    34KB

    MD5

    eb859fc7f54cba118a321440ad088096

    SHA1

    9d3c410240f4c5269e07ffbde43d6f5e7cc30b44

    SHA256

    14bdd15d60b9d6141009aeedc606007c42b46c779a523d21758e57cf126dc2a4

    SHA512

    694a9c1cc3dc78b47faedf66248ff078e5090cfab22e95c123fb99b10192a5748748a5f0937ffd9fd8e1873ad48f290be723fe194b7eb2a731add7f5fb776c4a

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_overlapped.pyd

    Filesize

    54KB

    MD5

    df92ea698a3d0729b70a4306bbe3029f

    SHA1

    b82f3a43568148c64a46e2774aec39bf1f2d3c1e

    SHA256

    46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032

    SHA512

    bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_queue.pyd

    Filesize

    31KB

    MD5

    7d91dd8e5f1dbc3058ea399f5f31c1e6

    SHA1

    b983653b9f2df66e721ece95f086c2f933d303fc

    SHA256

    76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d

    SHA512

    b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_socket.pyd

    Filesize

    81KB

    MD5

    e43aed7d6a8bcd9ddfc59c2d1a2c4b02

    SHA1

    36f367f68fb9868412246725b604b27b5019d747

    SHA256

    2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

    SHA512

    d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_ssl.pyd

    Filesize

    174KB

    MD5

    6a2b0f8f50b47d05f96deff7883c1270

    SHA1

    2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

    SHA256

    68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

    SHA512

    a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_tkinter.pyd

    Filesize

    64KB

    MD5

    e38a6b96f5cc200f21da22d49e321da3

    SHA1

    4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b

    SHA256

    f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20

    SHA512

    3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_uuid.pyd

    Filesize

    25KB

    MD5

    8f5402bb6aac9c4ff9b4ce5ac3f0f147

    SHA1

    87207e916d0b01047b311d78649763d6e001c773

    SHA256

    793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac

    SHA512

    65fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\_wmi.pyd

    Filesize

    36KB

    MD5

    bed7b0ced98fa065a9b8fe62e328713f

    SHA1

    e329ebca2df8889b78ce666e3fb909b4690d2daa

    SHA256

    5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94

    SHA512

    c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\aiohttp\_helpers.cp312-win_amd64.pyd

    Filesize

    54KB

    MD5

    46b9a0dc3c81fb53e6d3d0c0b665ad34

    SHA1

    84dcf992d3d39ad118d799a6db241e264efe3a63

    SHA256

    1fdae029896a54522f75291d2ce84a6b296bb0264ea8f2d2b9a46fbec16fee1e

    SHA512

    88424e43cda11d75feb4bb4af2a323c08feae4ac4251f5eee077fb62a9ced84632bc24c6523e6bd12a8a54b93160e510a631b30c725883149e61b10fbf5d84d5

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\aiohttp\_http_parser.cp312-win_amd64.pyd

    Filesize

    256KB

    MD5

    eb838f04e3f68266bf681800235f93be

    SHA1

    260a4caebee45a07cf5394a8fc8dbb76f3176344

    SHA256

    cd5463f593c4f0bb9fced6a868c449f237e2fba1a1cc8224b288c39674ce2bea

    SHA512

    4fe67a57e8cebf1c665b9b006f19baa8cd38f3a1f3c15cf60bb1dc92c26bb87564eb225a732e8babccdb1d375c5e49bf99850a3f23a9f2846f6485205282422d

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\aiohttp\_http_writer.cp312-win_amd64.pyd

    Filesize

    49KB

    MD5

    298c09cdb73ccdbea4af7dfd8c3f4c6a

    SHA1

    dde21d42bbad3a661d233885b3648b2324461880

    SHA256

    ee33769db55edd1c1081c97914559e4629446fd688b6de676eb12ad63c3ed48c

    SHA512

    cecf679c7e4faf1d0c2be7b90252bc616557161dcc3cb7600f92bb9eb39eb2697520f787f6f1aed36ffd206990cd75b99178662cdd2f15a4ebd2b9224422532f

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\aiohttp\_websocket.cp312-win_amd64.pyd

    Filesize

    36KB

    MD5

    79d28e2d26261ab3615e91ca6c25d66d

    SHA1

    79bcf07bac4f6ae124fda93b5fb79fd7b99d5ac3

    SHA256

    b96f6d3509f8420020c21e5448617ace540454585f1f3ac0f0f82f46d40ecd18

    SHA512

    e29aaa2a809c062dfb6a0db5eb9b2e36ac142df4e132dffd04374f97cac955aeba853b78f21052699c9198832c6cae123042b26f77ddb986a4a80bb3d75ef0b2

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\base_library.zip

    Filesize

    1.3MB

    MD5

    605cf0c0ef63fe301e94cbc073a503b8

    SHA1

    12589064c85195249a53656ea9a8ce6d1ae13ae6

    SHA256

    730a7bc70fdc6f06751d8f96604a5106563e0954602b0413f086956dbd3e9d5c

    SHA512

    9432476968b6dd04f9f6dd63987f7ce7693392f0d7b8f82d1f7a56e937607c016ec12d58c8fab32446ef1f2de55a0216767614eaae6f487a2bfc545ff4c78e4b

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\libcrypto-3.dll

    Filesize

    5.0MB

    MD5

    e547cf6d296a88f5b1c352c116df7c0c

    SHA1

    cafa14e0367f7c13ad140fd556f10f320a039783

    SHA256

    05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

    SHA512

    9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\libffi-8.dll

    Filesize

    38KB

    MD5

    0f8e4992ca92baaf54cc0b43aaccce21

    SHA1

    c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

    SHA256

    eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

    SHA512

    6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\libssl-3.dll

    Filesize

    768KB

    MD5

    19a2aba25456181d5fb572d88ac0e73e

    SHA1

    656ca8cdfc9c3a6379536e2027e93408851483db

    SHA256

    2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

    SHA512

    df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\multidict\_multidict.cp312-win_amd64.pyd

    Filesize

    45KB

    MD5

    ab3685f651c7821bbf03baf1d436b617

    SHA1

    f6306217ecaf5fa1dc8c78260d02dd2716903316

    SHA256

    1ef9e6eaff88cdcc0a32346b7b266a0e1d19716ecac07f16a189a7057ce971f9

    SHA512

    08e4d615ce5f9c565d54a16b1f475b6ad746b5d8e7f17248d235b5acd474333036bb33671c887bb64794b56ec910af28efbb7bed8bdea2eddd4bcd81c1b1fb70

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\py_cord-2.5.0.dist-info\METADATA

    Filesize

    6KB

    MD5

    818b190b84b157605bf224fc0696e380

    SHA1

    258fe977aacb4f97351d8889bf04c53d148fc88d

    SHA256

    44db2bc777a7c043ccdd31750bad0ee01e845e88ce73493bfcce604cbe169be9

    SHA512

    33141c88fe0ad298231dde07d91675ce5b9757402accf9a7c616849a2ccf8bb698d23854690d7025d82b4abeb584affa551915d6611e39d4855c93ffb693e1d8

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\pyexpat.pyd

    Filesize

    197KB

    MD5

    815f1bdabb79c6a12b38d84aa343196d

    SHA1

    916483149875a5e20c6046ceffef62dd6089ddd5

    SHA256

    31712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9

    SHA512

    1078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\python3.dll

    Filesize

    66KB

    MD5

    8dbe9bbf7118f4862e02cd2aaf43f1ab

    SHA1

    935bc8c5cea4502d0facf0c49c5f2b9c138608ed

    SHA256

    29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

    SHA512

    938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\python312.dll

    Filesize

    6.6MB

    MD5

    cae8fa4e7cb32da83acf655c2c39d9e1

    SHA1

    7a0055588a2d232be8c56791642cb0f5abbc71f8

    SHA256

    8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

    SHA512

    db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\select.pyd

    Filesize

    30KB

    MD5

    79ce1ae3a23dff6ed5fc66e6416600cd

    SHA1

    6204374d99144b0a26fd1d61940ff4f0d17c2212

    SHA256

    678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

    SHA512

    a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\tcl86t.dll

    Filesize

    1.7MB

    MD5

    3ae729942d15f4f48b1ea8c91880f1f4

    SHA1

    d27596d14af5adeb02edab74859b763bf6ac2853

    SHA256

    fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760

    SHA512

    355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\tk86t.dll

    Filesize

    1.5MB

    MD5

    966580716c0d6b7eec217071a6df6796

    SHA1

    e3d2d4a7ec61d920130d7a745586ceb7aad4184d

    SHA256

    afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2

    SHA512

    cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\unicodedata.pyd

    Filesize

    1.1MB

    MD5

    b848e259fabaf32b4b3c980a0a12488d

    SHA1

    da2e864e18521c86c7d8968db74bb2b28e4c23e2

    SHA256

    c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

    SHA512

    4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\yarl\_quoting_c.cp312-win_amd64.pyd

    Filesize

    94KB

    MD5

    44eb05d3c409e626ad417ed117068160

    SHA1

    dc0c4446e0601a2d341a09cda68ce6d2e466c040

    SHA256

    f306e375e186c011585dea2bc875530fb7d734861db388764a2aa307b1b68df3

    SHA512

    51194721d5ed968d40394f784a4708e6282d7c28b45b387165ae44eb5798f58432e85f743f798dae2c79722c88f5e8bb61c31ea37110781aa2368c6b4a4a45a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI34282\zlib1.dll

    Filesize

    143KB

    MD5

    4fadeda3c1da95337b67d15c282d49d8

    SHA1

    f49ee3256f8f5746515194114f7ef73d6b6141c0

    SHA256

    28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013

    SHA512

    45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

  • memory/4600-1082-0x00007FFC0DCA0000-0x00007FFC0DCCA000-memory.dmp

    Filesize

    168KB