Analysis

  • max time kernel
    280s
  • max time network
    292s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2023 18:39

General

  • Target

    f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc.exe

  • Size

    1.1MB

  • MD5

    501ea9669676ed72ed19f9fa79738e0e

  • SHA1

    5aea5bddb0fc0880a62d243e3d715b60fbe4e737

  • SHA256

    f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc

  • SHA512

    558d7d8d843379ad99c9691ad063fdfafd837ada2a0368ffa0c6a140eb6eebfec7441da51c4ebb9aa295a582c9b013fe831b2434c126590b0fe8cbdce6da3d8b

  • SSDEEP

    24576:4yeivpfUpu0mqCS6JREqDYVVN4saG+F7G/F3Rn/vDAFZ:/ZpfUDvXy18VVTa7wLsF

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

C2

185.161.248.75:4132

Attributes
  • auth_value

    60df3f535f8aa4e264f78041983592d2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc.exe
    "C:\Users\Admin\AppData\Local\Temp\f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5870881.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5870881.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6474909.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6474909.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6558570.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6558570.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2648
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3472451.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3472451.exe
          4⤵
          • Executes dropped EXE
          PID:4152
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 928
            5⤵
            • Program crash
            PID:3312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3768
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
          "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2128
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of UnmapMainImage
            PID:4388
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 12
              6⤵
              • Program crash
              PID:1248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4152 -ip 4152
    1⤵
      PID:1552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 4388
      1⤵
        PID:4948

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r2996407.exe.log
        Filesize

        425B

        MD5

        4eaca4566b22b01cd3bc115b9b0b2196

        SHA1

        e743e0792c19f71740416e7b3c061d9f1336bf94

        SHA256

        34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

        SHA512

        bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3326468.exe
        Filesize

        961KB

        MD5

        548c9c8514f2395e59e7cca8589f75f2

        SHA1

        13b7a0ab4d815e5ec1ec25a4fea96754719e06e8

        SHA256

        6fcedb5480727f1018f2186daf6cba71c2f8f063ba2415287b6457df2cf07f0b

        SHA512

        7e65b466642172fd99733c7de8eaa35b50827a74b36f2a43ff90bbf7aee6cde7af37ee41e5fe3957ad4ea4b19b7f7c4c589f0d43e1eb090f9ea9363fd9e6d78b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5870881.exe
        Filesize

        702KB

        MD5

        5378764133b66f45fb434bedee1a53a0

        SHA1

        06d76f15884bf5c4136c366780384188d91dfdb8

        SHA256

        5beccf4fe809beed67380f839aecb43d87edd24e72c4ae2bd338de789e09f0f2

        SHA512

        9aef7a372ef4ae511006d7d815d8a619904d3eb5fa26d8cd4e16d3a9ecdecc7bad2411aaca0d2902cae99ed8157a1eaacc9edc51858cd3378062977319c72a1f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5870881.exe
        Filesize

        702KB

        MD5

        5378764133b66f45fb434bedee1a53a0

        SHA1

        06d76f15884bf5c4136c366780384188d91dfdb8

        SHA256

        5beccf4fe809beed67380f839aecb43d87edd24e72c4ae2bd338de789e09f0f2

        SHA512

        9aef7a372ef4ae511006d7d815d8a619904d3eb5fa26d8cd4e16d3a9ecdecc7bad2411aaca0d2902cae99ed8157a1eaacc9edc51858cd3378062977319c72a1f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
        Filesize

        904KB

        MD5

        b9971030c33d46559914db76f2c74237

        SHA1

        8f09954e4c8f74902950accdb78e8c0ed64f3cf6

        SHA256

        e5f2629080f56f32c80daf4744486a16caa06d4f4cfea53647a21227930df523

        SHA512

        bbdd009eaa6546f094fae74ac251534415097d5726971e9cdf8c954e5595aedfaf09a2b0674050e706e0e946cc72e2b044448ffb4bd4112b99adfa25b379ca0e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
        Filesize

        904KB

        MD5

        b9971030c33d46559914db76f2c74237

        SHA1

        8f09954e4c8f74902950accdb78e8c0ed64f3cf6

        SHA256

        e5f2629080f56f32c80daf4744486a16caa06d4f4cfea53647a21227930df523

        SHA512

        bbdd009eaa6546f094fae74ac251534415097d5726971e9cdf8c954e5595aedfaf09a2b0674050e706e0e946cc72e2b044448ffb4bd4112b99adfa25b379ca0e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2996407.exe
        Filesize

        904KB

        MD5

        b9971030c33d46559914db76f2c74237

        SHA1

        8f09954e4c8f74902950accdb78e8c0ed64f3cf6

        SHA256

        e5f2629080f56f32c80daf4744486a16caa06d4f4cfea53647a21227930df523

        SHA512

        bbdd009eaa6546f094fae74ac251534415097d5726971e9cdf8c954e5595aedfaf09a2b0674050e706e0e946cc72e2b044448ffb4bd4112b99adfa25b379ca0e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6474909.exe
        Filesize

        306KB

        MD5

        8577097a3971b5468955bdbcc3eba0d3

        SHA1

        68073ce1091a8f35fb5246081031f97a02b27f38

        SHA256

        4a4ba8405e6ceefbba9f5e865af0c3b2d7e39f8bba9c2a18364ab2635a9a2dff

        SHA512

        f1f133eb66707c91153baff9c583e7969ffaf1e2330636e7c2151292296e84042ad17ac36b164fafdbcb330635af458d7308e6a6da7e99c1f76c1ad27df44685

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6474909.exe
        Filesize

        306KB

        MD5

        8577097a3971b5468955bdbcc3eba0d3

        SHA1

        68073ce1091a8f35fb5246081031f97a02b27f38

        SHA256

        4a4ba8405e6ceefbba9f5e865af0c3b2d7e39f8bba9c2a18364ab2635a9a2dff

        SHA512

        f1f133eb66707c91153baff9c583e7969ffaf1e2330636e7c2151292296e84042ad17ac36b164fafdbcb330635af458d7308e6a6da7e99c1f76c1ad27df44685

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6558570.exe
        Filesize

        185KB

        MD5

        b536f7a6995726c9cebb3c3a079b54f7

        SHA1

        c31b723d2116a517ebc47f6edbaedef0218f687d

        SHA256

        0d7e9871bcdba06b4f921a260136fb7805950515d585f8443f798e0a711d0d89

        SHA512

        70218a43f5120fa048ce42480c2a859642d7e86fefc1a8e9c15a3c75af0b3d1b57f9ad868f2e3e853ccb6bc40921b83c75339c9a5e5253295777bbced32bc660

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6558570.exe
        Filesize

        185KB

        MD5

        b536f7a6995726c9cebb3c3a079b54f7

        SHA1

        c31b723d2116a517ebc47f6edbaedef0218f687d

        SHA256

        0d7e9871bcdba06b4f921a260136fb7805950515d585f8443f798e0a711d0d89

        SHA512

        70218a43f5120fa048ce42480c2a859642d7e86fefc1a8e9c15a3c75af0b3d1b57f9ad868f2e3e853ccb6bc40921b83c75339c9a5e5253295777bbced32bc660

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3472451.exe
        Filesize

        145KB

        MD5

        9fd4e53d8a023e9d99440f16d5da3736

        SHA1

        9c94d682d6156c534cbfd694e68f610ac7e46271

        SHA256

        6d2dc3b0b15a0081d37074b4e5f3ec45ee5e0c80b19331b513a290da23f0df08

        SHA512

        d8ecc8b7a0911b9afe09366e3f64ea22da6e8a0b475f70a37c9d91c5d8017700f65a2482146f5e101562331c550d77bd247fe141ce634e3f3842fc1c8decbb0d

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3472451.exe
        Filesize

        145KB

        MD5

        9fd4e53d8a023e9d99440f16d5da3736

        SHA1

        9c94d682d6156c534cbfd694e68f610ac7e46271

        SHA256

        6d2dc3b0b15a0081d37074b4e5f3ec45ee5e0c80b19331b513a290da23f0df08

        SHA512

        d8ecc8b7a0911b9afe09366e3f64ea22da6e8a0b475f70a37c9d91c5d8017700f65a2482146f5e101562331c550d77bd247fe141ce634e3f3842fc1c8decbb0d

      • memory/2128-231-0x0000000007CC0000-0x0000000007CD0000-memory.dmp
        Filesize

        64KB

      • memory/2648-161-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-165-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-181-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-184-0x0000000004A60000-0x0000000004A70000-memory.dmp
        Filesize

        64KB

      • memory/2648-185-0x0000000004A60000-0x0000000004A70000-memory.dmp
        Filesize

        64KB

      • memory/2648-186-0x0000000004A60000-0x0000000004A70000-memory.dmp
        Filesize

        64KB

      • memory/2648-179-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-177-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-175-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-173-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-171-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-169-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-167-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-183-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-163-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-159-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-157-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-154-0x0000000004A70000-0x0000000005014000-memory.dmp
        Filesize

        5.6MB

      • memory/2648-156-0x0000000005060000-0x0000000005076000-memory.dmp
        Filesize

        88KB

      • memory/2648-155-0x0000000004A60000-0x0000000004A70000-memory.dmp
        Filesize

        64KB

      • memory/2812-205-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/2812-208-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/2812-209-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/2812-229-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/2812-212-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/3768-196-0x0000000007340000-0x0000000007350000-memory.dmp
        Filesize

        64KB

      • memory/3768-195-0x0000000000460000-0x0000000000548000-memory.dmp
        Filesize

        928KB

      • memory/4152-191-0x0000000000A20000-0x0000000000A4A000-memory.dmp
        Filesize

        168KB

      • memory/4300-211-0x00000000059E0000-0x0000000005FF8000-memory.dmp
        Filesize

        6.1MB

      • memory/4300-238-0x0000000007430000-0x000000000795C000-memory.dmp
        Filesize

        5.2MB

      • memory/4300-214-0x0000000005430000-0x0000000005442000-memory.dmp
        Filesize

        72KB

      • memory/4300-215-0x00000000057D0000-0x00000000057E0000-memory.dmp
        Filesize

        64KB

      • memory/4300-241-0x0000000006C60000-0x0000000006CB0000-memory.dmp
        Filesize

        320KB

      • memory/4300-197-0x0000000000400000-0x000000000042A000-memory.dmp
        Filesize

        168KB

      • memory/4300-216-0x0000000005490000-0x00000000054CC000-memory.dmp
        Filesize

        240KB

      • memory/4300-235-0x0000000006000000-0x0000000006092000-memory.dmp
        Filesize

        584KB

      • memory/4300-236-0x0000000005950000-0x00000000059B6000-memory.dmp
        Filesize

        408KB

      • memory/4300-237-0x0000000006D30000-0x0000000006EF2000-memory.dmp
        Filesize

        1.8MB

      • memory/4300-213-0x0000000005500000-0x000000000560A000-memory.dmp
        Filesize

        1.0MB

      • memory/4300-239-0x00000000057D0000-0x00000000057E0000-memory.dmp
        Filesize

        64KB

      • memory/4300-240-0x0000000006BE0000-0x0000000006C56000-memory.dmp
        Filesize

        472KB

      • memory/4388-242-0x00000000003B0000-0x00000000003B0000-memory.dmp
      • memory/4824-203-0x00000000000F0000-0x00000000001E6000-memory.dmp
        Filesize

        984KB

      • memory/4824-204-0x0000000006F60000-0x0000000006F70000-memory.dmp
        Filesize

        64KB