Resubmissions

15-03-2022 08:05

220315-jy3feaahdk 10

15-03-2022 07:24

220315-h8lpzaghf8 10

Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    15-03-2022 07:24

General

  • Target

    Restr.exe

  • Size

    252KB

  • MD5

    16959900ff34c0ba60fe2a4d9f1242c5

  • SHA1

    888148f1b31355192e26ea4fc97c91f4c4defe9e

  • SHA256

    0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f

  • SHA512

    a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54

Score
10/10

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2996
      • C:\Users\Admin\AppData\Local\Temp\Restr.exe
        "C:\Users\Admin\AppData\Local\Temp\Restr.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 684
          3⤵
          • Program crash
          PID:1224
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2956
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA=
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4624
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3716
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:228
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghia3nh3\ghia3nh3.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:988
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FA4.tmp" "c:\Users\Admin\AppData\Local\Temp\ghia3nh3\CSC27BEC1645D2B4DB4B060ACD19CF88B1.TMP"
                  7⤵
                    PID:4764
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\15u10d5z\15u10d5z.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4468
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES312A.tmp" "c:\Users\Admin\AppData\Local\Temp\15u10d5z\CSCF125F687492A430B9A63A17B8B80657.TMP"
                    7⤵
                      PID:3232
        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
          1⤵
            PID:4572
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4760
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4636
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82950 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2500
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82954 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:856
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82958 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3212
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82962 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4152
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82966 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1148
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82970 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2448
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17412 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4460
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17414 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3216
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82978 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3616
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82982 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2372
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 4104
            1⤵
              PID:388

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

              MD5

              54e9306f95f32e50ccd58af19753d929

              SHA1

              eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

              SHA256

              45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

              SHA512

              8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

              MD5

              6433da6e116e23f2c4388dbc6893ba6c

              SHA1

              fcdb3be2a097789a35caef8f27cd7493e29fb396

              SHA256

              56227dccdbfa7c45e927438f5f5754b60ed0bdc368d8285c4740753a31305985

              SHA512

              d3c1774d78446a1389d502f6c84ca386be3ff8e68aa24a6a29488a3e7675a810a416c9820843045adc7b200a9612d42cfb739682233ae4e95ca611a47050d05a

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2psodd8\imagestore.dat

              MD5

              06cc70d0cfe0ddc293afb580402104e3

              SHA1

              a0b28ea12c39b2d0b1a45aeaf81f4bcee851b3db

              SHA256

              56fdf8ee0e5aa100d91e6d2bbd0c4d2e9a8265e130f474fdf7b41cc8640a39c1

              SHA512

              62988ebadb3b88d4bec0a3b4086ecd0b5ff5f76f894978f972b1b4b0996dea2b0b7e33a9244c6abf1acfa4c99d3a9534b29c7f206d3e5157f91a77f0a4a3c22a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GGB3KH7Z\favicon[2].ico

              MD5

              a976d227e5d1dcf62f5f7e623211dd1b

              SHA1

              a2a9dc1abdd3d888484678663928cb024c359ee6

              SHA256

              66332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271

              SHA512

              6754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              MD5

              a6c9d692ed2826ecb12c09356e69cc09

              SHA1

              def728a6138cf083d8a7c61337f3c9dade41a37f

              SHA256

              a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

              SHA512

              2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              MD5

              56eed407989b43f7fc53e2e7a47ab967

              SHA1

              a5c6b2f493199a08fabee50e6d588773952148f0

              SHA256

              efee8d1f6796868b832708e0b20a86e65736958419f2f7bbc97eb5d93346c6d3

              SHA512

              c15dfa9eb19eb2f7859043956f68f231c173c752409150f76fc0555cec11faf77aca175207ece0cad37767d72bd92af1969aba39f7be7c8df2fe0521bb426e64

            • C:\Users\Admin\AppData\Local\Temp\15u10d5z\15u10d5z.dll

              MD5

              116861649741ab5ee8953c95836aa55f

              SHA1

              c299529e1007f6f720196e447ae065244578cf28

              SHA256

              843dad148fdf4eb0e238b3da0c77c43a321c60db3bc0a497b27ae0dd1bc9f8d9

              SHA512

              29ed2eff6d0e6f9eddc94619e83e69f2eef103b34fead7fe57e63f1979f8108a8f0fc7ccd02c104e25020364fc41114f9c9b5cc52e542934f0aaa5134994e3c6

            • C:\Users\Admin\AppData\Local\Temp\RES2FA4.tmp

              MD5

              28ad96b363c407deccbc2accde3005a1

              SHA1

              e44402e1a888c864697e2aaaad77403e1ed8faa0

              SHA256

              6bbabc629b56271ea17b81655be5a6797d1fac265004887002e0998542702be8

              SHA512

              cada852fe6b6cd66e3fa8fbad6b6a393cf0a2e73a0d9b3b8c280cb3c33e9723334c483af3800a3a21d77a185bb5e54e4230071fc4f3636b6eb04d09f77a31eaa

            • C:\Users\Admin\AppData\Local\Temp\RES312A.tmp

              MD5

              83ab356e22e539208e002146438cc00f

              SHA1

              700b19780616385c7b44c544ee3028dc5c435c30

              SHA256

              ea0fd02c5ae345916969ae7bf2b98ee39977ce634dff92a31a338d56bf350550

              SHA512

              72d5fbae9c84943959394a83dc325b49a54571808d5241784738c979d8b6a6602e80a92a3890ed558a76d66fc59c08460a79e3fceb79952c8bab8e4eea7643d9

            • C:\Users\Admin\AppData\Local\Temp\ghia3nh3\ghia3nh3.dll

              MD5

              ab820512bcc23272f20e3e6acbb6a109

              SHA1

              3a4df0c01dabc15c513396ec0e249f6028a6dfef

              SHA256

              07ab18ec29ddef7ae4819ecc20a5e3a2cf07e2d5342b88ea332bca9b650af6e3

              SHA512

              f4b1bb948100f1cb60c0ef344b1de82864ffeb8592d8e201964c0f351277102e7b41cbdbce561d812a1d32108b4d1abfd3d4daeec994679deedb5a4504eeef1c

            • \??\c:\Users\Admin\AppData\Local\Temp\15u10d5z\15u10d5z.0.cs

              MD5

              697f16b8c6892082559d8a17db343865

              SHA1

              246d6ba1419478be7915e78b61525da894321fb9

              SHA256

              518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f

              SHA512

              801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6

            • \??\c:\Users\Admin\AppData\Local\Temp\15u10d5z\15u10d5z.cmdline

              MD5

              f8ae56a095376eb80a636d564308422f

              SHA1

              6086a5df68ba0469ec689cdd2bebd0583605c861

              SHA256

              fcad36328c8120d1499b691218f4648e04620f689dd9dd68c1bf30bea004e156

              SHA512

              2595a8c41bc692779d9d658e30ca22aa6ead8c4c3d34b68c9eb7e1d0478f4f2880af4aed745a393b2e60faa1bf391f48437f3dc63ef96982c7b546cdd1c72a89

            • \??\c:\Users\Admin\AppData\Local\Temp\15u10d5z\CSCF125F687492A430B9A63A17B8B80657.TMP

              MD5

              ccd592f6efece8859db195c81f852a00

              SHA1

              ba5d05bf1149d7efbb7246434a68a17aafa98920

              SHA256

              3d65fdbbd64f8acdef43152eb270252e61c968064e42e5920dc49e7cf6ea5772

              SHA512

              1f9f7ceaca8429b16f5eedcca43e3c69204e5c53c4af50e819ac6beef9964f9ed162f38b7c75bd955b4f696f60f3356f6a6606d3a62ddbef93406e21c1449a0a

            • \??\c:\Users\Admin\AppData\Local\Temp\ghia3nh3\CSC27BEC1645D2B4DB4B060ACD19CF88B1.TMP

              MD5

              5681486182205dbfa2f7e4efae349e53

              SHA1

              e023b20452744323d5730e7df6347bd492bbceb8

              SHA256

              bc643365bd00647890e34534d3e91f05f891a4e870c6ed9606df8ba29c2396a1

              SHA512

              599713f5052968785cb36f8b245c2f1cd94f91422b96cd845152c98fd2cb0a22c1d9de20d4410ab2f80096c6f5270e1ffb0a4e26b961ad025f14d906b9250c3e

            • \??\c:\Users\Admin\AppData\Local\Temp\ghia3nh3\ghia3nh3.0.cs

              MD5

              7fceb996f934e8bda687cdd2bd46a9a7

              SHA1

              81e1edbcca6438daaccc3845fa0e3b1a6cff17a6

              SHA256

              fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e

              SHA512

              6aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205

            • \??\c:\Users\Admin\AppData\Local\Temp\ghia3nh3\ghia3nh3.cmdline

              MD5

              f482e58085e5a042c0f7e6b4df01406f

              SHA1

              aa11735f9ae740c6d46bcf58534dc0ab69fa415c

              SHA256

              f55fbb36261bf5e25b4d390f31a5c27d383772c2e94b30482fb579f08b500a61

              SHA512

              3191bae0b1f390ef29d69196d73bfb92713599f389d87cc284b856a27e6ac176bf59c5509da6f08e25be5a82f680630eaaaf0fcf64dc1aa8626d3aff4e7ae953

            • memory/228-162-0x0000024E2B6A0000-0x0000024E2B75D000-memory.dmp

              Filesize

              756KB

            • memory/228-159-0x0000024E2ABD0000-0x0000024E2B691000-memory.dmp

              Filesize

              10.8MB

            • memory/228-160-0x0000024E2B6A0000-0x0000024E2B75D000-memory.dmp

              Filesize

              756KB

            • memory/228-161-0x0000024E2B6A0000-0x0000024E2B75D000-memory.dmp

              Filesize

              756KB

            • memory/2996-177-0x0000000001590000-0x00000000015A5000-memory.dmp

              Filesize

              84KB

            • memory/2996-176-0x00000000015B0000-0x00000000015C5000-memory.dmp

              Filesize

              84KB

            • memory/3716-155-0x000001EA1BE33000-0x000001EA1BE35000-memory.dmp

              Filesize

              8KB

            • memory/3716-156-0x000001EA1BE36000-0x000001EA1BE38000-memory.dmp

              Filesize

              8KB

            • memory/3716-150-0x000001EA1DD30000-0x000001EA1E7F1000-memory.dmp

              Filesize

              10.8MB

            • memory/3716-154-0x000001EA1BE30000-0x000001EA1BE32000-memory.dmp

              Filesize

              8KB

            • memory/4104-136-0x00000000005B0000-0x00000000005BC000-memory.dmp

              Filesize

              48KB

            • memory/4104-134-0x000000000042E000-0x000000000043A000-memory.dmp

              Filesize

              48KB

            • memory/4104-138-0x0000000000D30000-0x0000000000D40000-memory.dmp

              Filesize

              64KB

            • memory/4104-135-0x000000000042E000-0x000000000043A000-memory.dmp

              Filesize

              48KB

            • memory/4104-175-0x00000000001C0000-0x00000000001CE000-memory.dmp

              Filesize

              56KB

            • memory/4104-137-0x0000000001000000-0x000000000106F000-memory.dmp

              Filesize

              444KB

            • memory/4624-153-0x0000023D2A5A6000-0x0000023D2A5A8000-memory.dmp

              Filesize

              8KB

            • memory/4624-152-0x0000023D2A5A3000-0x0000023D2A5A5000-memory.dmp

              Filesize

              8KB

            • memory/4624-151-0x0000023D2A5A0000-0x0000023D2A5A2000-memory.dmp

              Filesize

              8KB

            • memory/4624-149-0x0000023D11640000-0x0000023D12101000-memory.dmp

              Filesize

              10.8MB

            • memory/4624-173-0x0000023D2A560000-0x0000023D2A573000-memory.dmp

              Filesize

              76KB

            • memory/4624-148-0x0000023D2A4D0000-0x0000023D2A4F2000-memory.dmp

              Filesize

              136KB