Analysis

  • max time kernel
    136s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2023 01:13

General

  • Target

    5651cc4a142270f16a9c282e4b06073e960cf3e00896115cacd890dc2531d1d5.exe

  • Size

    1.1MB

  • MD5

    2d839e807fc130cc84c9cd45fc50437d

  • SHA1

    a5c001ef2b176252d96deee16087102c8aeb89dc

  • SHA256

    5651cc4a142270f16a9c282e4b06073e960cf3e00896115cacd890dc2531d1d5

  • SHA512

    884cfea01099bccd0e22be79d1b4448b7eed39cf4c3871459943b7496c92541d6392edf56f5aed46f9bf8a933a382971f67d1b764c71842f4210a6b54d3c7017

  • SSDEEP

    24576:oyDUGiyNung9/GH4qn2DtmYWsVrHI/Cg34lSrhDu8:vDUxyY/H3n7s9HICu

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

C2

185.161.248.75:4132

Attributes
  • auth_value

    60df3f535f8aa4e264f78041983592d2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5651cc4a142270f16a9c282e4b06073e960cf3e00896115cacd890dc2531d1d5.exe
    "C:\Users\Admin\AppData\Local\Temp\5651cc4a142270f16a9c282e4b06073e960cf3e00896115cacd890dc2531d1d5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1496754.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1496754.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9792767.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9792767.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6716188.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6716188.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4676
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9819606.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9819606.exe
          4⤵
          • Executes dropped EXE
          PID:3484
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 928
            5⤵
            • Program crash
            PID:628
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
          "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5044
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of UnmapMainImage
            PID:4988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 12
              6⤵
              • Program crash
              PID:3744
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3484 -ip 3484
    1⤵
      PID:3716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4988 -ip 4988
      1⤵
        PID:4308
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:2908

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r9033346.exe.log
        Filesize

        425B

        MD5

        4eaca4566b22b01cd3bc115b9b0b2196

        SHA1

        e743e0792c19f71740416e7b3c061d9f1336bf94

        SHA256

        34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

        SHA512

        bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0584254.exe
        Filesize

        961KB

        MD5

        9d0e47ef49333aa8f4e58f0cd0bda7c3

        SHA1

        63fad7d7c9bed947de8f823e1f65866a841e5e3b

        SHA256

        dc5130b4f361501d0b1c0f17ab8bac881b0b7bfa17edeadc9f19e2dbf192dcc3

        SHA512

        160e28478d0181f188048cf1fc38973d99bc5aeb867913516b805e527d8233e47f73d0085c59000fd2eddaf207e461ed1922f8a08cb4ff21d01dbd52c440dcd8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1496754.exe
        Filesize

        702KB

        MD5

        b7db5d481656f1d639e77319a9f68333

        SHA1

        de513d717b52a405465550efafb1017e3f2b8580

        SHA256

        bcf187b57424834502564d712852b435592ddfdbc4fe43d99cca5feea4ae7944

        SHA512

        3898849a0c69f4b151de0bbfad082adbd58bb75bce1a4293c789cf12fc425592a6838b91a6b308d52c52ba72e88d52869401fdbb7f53b8f7bb06c4278d7d0535

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1496754.exe
        Filesize

        702KB

        MD5

        b7db5d481656f1d639e77319a9f68333

        SHA1

        de513d717b52a405465550efafb1017e3f2b8580

        SHA256

        bcf187b57424834502564d712852b435592ddfdbc4fe43d99cca5feea4ae7944

        SHA512

        3898849a0c69f4b151de0bbfad082adbd58bb75bce1a4293c789cf12fc425592a6838b91a6b308d52c52ba72e88d52869401fdbb7f53b8f7bb06c4278d7d0535

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
        Filesize

        904KB

        MD5

        c63edf23a31708ab0bc120a26fb86b6e

        SHA1

        aac19017eac3e2e24e0cf1e2cba04c353fe7cb55

        SHA256

        7f6ae09cada5c20b05cec17603fc7f8d51fddf1703a0618336b00a3403cac467

        SHA512

        111d47104bd1e2de953082166c063e4b042c53fdd77895aa52ef32eff8f9f2612aef88255d43d0485c6485f7c8b8206bd56ebb804eff2491c07492714453468e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
        Filesize

        904KB

        MD5

        c63edf23a31708ab0bc120a26fb86b6e

        SHA1

        aac19017eac3e2e24e0cf1e2cba04c353fe7cb55

        SHA256

        7f6ae09cada5c20b05cec17603fc7f8d51fddf1703a0618336b00a3403cac467

        SHA512

        111d47104bd1e2de953082166c063e4b042c53fdd77895aa52ef32eff8f9f2612aef88255d43d0485c6485f7c8b8206bd56ebb804eff2491c07492714453468e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9033346.exe
        Filesize

        904KB

        MD5

        c63edf23a31708ab0bc120a26fb86b6e

        SHA1

        aac19017eac3e2e24e0cf1e2cba04c353fe7cb55

        SHA256

        7f6ae09cada5c20b05cec17603fc7f8d51fddf1703a0618336b00a3403cac467

        SHA512

        111d47104bd1e2de953082166c063e4b042c53fdd77895aa52ef32eff8f9f2612aef88255d43d0485c6485f7c8b8206bd56ebb804eff2491c07492714453468e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9792767.exe
        Filesize

        306KB

        MD5

        4b376b3b3e2729da688b6383c85d4d1e

        SHA1

        92880e312b8c9728cdd4cda70c2430f96fd73940

        SHA256

        9bc144f7576f3b07891b32bd4faa6d3d915b2e1610b11b1a5079eb12814ea78d

        SHA512

        db386a73812b1962ab33aa5470309cec70a95876b6a5b8371c680b90e53ba416b42ad77a90abd34b2832b773b1fa86aa07e2281d544de48cdbac5eaaa00ab3ba

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9792767.exe
        Filesize

        306KB

        MD5

        4b376b3b3e2729da688b6383c85d4d1e

        SHA1

        92880e312b8c9728cdd4cda70c2430f96fd73940

        SHA256

        9bc144f7576f3b07891b32bd4faa6d3d915b2e1610b11b1a5079eb12814ea78d

        SHA512

        db386a73812b1962ab33aa5470309cec70a95876b6a5b8371c680b90e53ba416b42ad77a90abd34b2832b773b1fa86aa07e2281d544de48cdbac5eaaa00ab3ba

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6716188.exe
        Filesize

        184KB

        MD5

        8942e13d98b3d6bf3f4903baa17313b3

        SHA1

        ea8a779e9bd8241826424d6feb2c8a9c933d4356

        SHA256

        cb71ae5dfd394e9222353279569f13f8a4312fe3d7ac6945a263307c6414f65d

        SHA512

        4cb240e86b237ba628bba89c69c85d793244f7454baf113f0b9159963292072dcfeb9057d808b4f62bb07cf84a0b9379b2371e09f46a0d41f4adb63b5960c9b1

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6716188.exe
        Filesize

        184KB

        MD5

        8942e13d98b3d6bf3f4903baa17313b3

        SHA1

        ea8a779e9bd8241826424d6feb2c8a9c933d4356

        SHA256

        cb71ae5dfd394e9222353279569f13f8a4312fe3d7ac6945a263307c6414f65d

        SHA512

        4cb240e86b237ba628bba89c69c85d793244f7454baf113f0b9159963292072dcfeb9057d808b4f62bb07cf84a0b9379b2371e09f46a0d41f4adb63b5960c9b1

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9819606.exe
        Filesize

        145KB

        MD5

        dcc71fdacb65262d4a707bc1aaba72bb

        SHA1

        0f3b4c5203f43319442c096d8c3c6ea2de826e92

        SHA256

        7f80912d52e1ecf2f90cf835fac4e6799aea697fba7969775f8e6e263263f41c

        SHA512

        9b9bb87c056a38240395e0e9c212afa02b154a8f1c1b99721b3afe4ecae79f127d5344f4d062f7ea379574a56b45ecf153087d91e429025caedc60b699e036d9

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9819606.exe
        Filesize

        145KB

        MD5

        dcc71fdacb65262d4a707bc1aaba72bb

        SHA1

        0f3b4c5203f43319442c096d8c3c6ea2de826e92

        SHA256

        7f80912d52e1ecf2f90cf835fac4e6799aea697fba7969775f8e6e263263f41c

        SHA512

        9b9bb87c056a38240395e0e9c212afa02b154a8f1c1b99721b3afe4ecae79f127d5344f4d062f7ea379574a56b45ecf153087d91e429025caedc60b699e036d9

      • memory/1432-206-0x0000000007490000-0x00000000074A0000-memory.dmp
        Filesize

        64KB

      • memory/1432-205-0x0000000000510000-0x0000000000606000-memory.dmp
        Filesize

        984KB

      • memory/3484-192-0x0000000000640000-0x000000000066A000-memory.dmp
        Filesize

        168KB

      • memory/3728-235-0x0000000006440000-0x00000000064A6000-memory.dmp
        Filesize

        408KB

      • memory/3728-211-0x00000000058A0000-0x00000000058B0000-memory.dmp
        Filesize

        64KB

      • memory/3728-208-0x0000000005900000-0x0000000005A0A000-memory.dmp
        Filesize

        1.0MB

      • memory/3728-209-0x0000000005830000-0x0000000005842000-memory.dmp
        Filesize

        72KB

      • memory/3728-234-0x0000000005BD0000-0x0000000005C62000-memory.dmp
        Filesize

        584KB

      • memory/3728-239-0x0000000006F30000-0x0000000006FA6000-memory.dmp
        Filesize

        472KB

      • memory/3728-210-0x00000000058B0000-0x00000000058EC000-memory.dmp
        Filesize

        240KB

      • memory/3728-207-0x0000000005DB0000-0x00000000063C8000-memory.dmp
        Filesize

        6.1MB

      • memory/3728-240-0x0000000006FB0000-0x0000000007000000-memory.dmp
        Filesize

        320KB

      • memory/3728-241-0x00000000071D0000-0x0000000007392000-memory.dmp
        Filesize

        1.8MB

      • memory/3728-243-0x00000000058A0000-0x00000000058B0000-memory.dmp
        Filesize

        64KB

      • memory/3728-242-0x00000000078D0000-0x0000000007DFC000-memory.dmp
        Filesize

        5.2MB

      • memory/3728-198-0x0000000000400000-0x000000000042A000-memory.dmp
        Filesize

        168KB

      • memory/4548-197-0x0000000007290000-0x00000000072A0000-memory.dmp
        Filesize

        64KB

      • memory/4548-196-0x00000000004A0000-0x0000000000588000-memory.dmp
        Filesize

        928KB

      • memory/4676-169-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-163-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-186-0x0000000004B90000-0x0000000004BA0000-memory.dmp
        Filesize

        64KB

      • memory/4676-185-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-183-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-181-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-179-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-177-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-175-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-154-0x0000000004B90000-0x0000000004BA0000-memory.dmp
        Filesize

        64KB

      • memory/4676-173-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-155-0x0000000004B90000-0x0000000004BA0000-memory.dmp
        Filesize

        64KB

      • memory/4676-156-0x0000000004B90000-0x0000000004BA0000-memory.dmp
        Filesize

        64KB

      • memory/4676-157-0x0000000004BA0000-0x0000000005144000-memory.dmp
        Filesize

        5.6MB

      • memory/4676-171-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-167-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-158-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-165-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-159-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4676-187-0x0000000004B90000-0x0000000004BA0000-memory.dmp
        Filesize

        64KB

      • memory/4676-161-0x0000000004AB0000-0x0000000004AC6000-memory.dmp
        Filesize

        88KB

      • memory/4864-232-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/4864-218-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/4864-216-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/4864-215-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/4864-212-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/4988-244-0x00000000003F0000-0x00000000003F0000-memory.dmp
      • memory/5044-233-0x0000000007C80000-0x0000000007C90000-memory.dmp
        Filesize

        64KB