Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:58

General

  • Target

    324fed0c5b9ec330da097db8ee010e5657550be7cf4712a26497a6533fe41e92.exe

  • Size

    1.3MB

  • MD5

    2ddceb28bfbb1478a002dc497db435e6

  • SHA1

    b6903437c76da6108007f53b7277f5a57a323a40

  • SHA256

    324fed0c5b9ec330da097db8ee010e5657550be7cf4712a26497a6533fe41e92

  • SHA512

    5b983a139a6d8a3922c5ec4cbb1516b2153578838089bf34da74d9658398582d44ee11f5d343eebb27de83a6d52388c8d4c2b00fd82af82c41ee70c864cb5cbd

  • SSDEEP

    24576:6yCfCCVO7xUQIg3zLZYvDsn+ee/e98jAxIIynOSnjrP4b:BCfXZQZ3Uk+ee29ybn7w

Malware Config

Extracted

Family

redline

Botnet

darts

C2

77.91.124.82:19071

Attributes
  • auth_value

    3c8818da7045365845f15ec0946ebf11

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\324fed0c5b9ec330da097db8ee010e5657550be7cf4712a26497a6533fe41e92.exe
    "C:\Users\Admin\AppData\Local\Temp\324fed0c5b9ec330da097db8ee010e5657550be7cf4712a26497a6533fe41e92.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6664528.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6664528.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3240745.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3240745.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8778165.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8778165.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4832149.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4832149.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:968
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5187228.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5187228.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3672
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7101377.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7101377.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4040
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2680
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 552
                  8⤵
                  • Program crash
                  PID:4512
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3953895.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3953895.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4396
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                    PID:956
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    8⤵
                      PID:4436
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      8⤵
                        PID:5080
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 540
                          9⤵
                          • Program crash
                          PID:2572
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 572
                        8⤵
                        • Program crash
                        PID:3268
                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c1532064.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c1532064.exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:4988
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      7⤵
                        PID:4564
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 552
                        7⤵
                        • Program crash
                        PID:1600
                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d8628052.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d8628052.exe
                    5⤵
                    • Executes dropped EXE
                    PID:444
                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e4075088.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e4075088.exe
                  4⤵
                  • Executes dropped EXE
                  PID:3940
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4040 -ip 4040
            1⤵
              PID:4508
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4396 -ip 4396
              1⤵
                PID:3788
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5080 -ip 5080
                1⤵
                  PID:3112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4988 -ip 4988
                  1⤵
                    PID:1260

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6664528.exe

                    Filesize

                    1.2MB

                    MD5

                    43e9f0cca5bdc04bb5d6082f84adf082

                    SHA1

                    b0c4751ca8dc2e1459201774e7ae4dd40d107ec2

                    SHA256

                    790ae24ad9404f368e52e9ee1450ad981f31de281dd989a316637bffc98eca1c

                    SHA512

                    1fa026e8de0dc5f94c2653ed96d9549f86ae30351a9d22a2b61ef51b54853fa46628015872b83f003f1afdc8fa28a4faba94c83d0e7d09b97e1ea96631498503

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6664528.exe

                    Filesize

                    1.2MB

                    MD5

                    43e9f0cca5bdc04bb5d6082f84adf082

                    SHA1

                    b0c4751ca8dc2e1459201774e7ae4dd40d107ec2

                    SHA256

                    790ae24ad9404f368e52e9ee1450ad981f31de281dd989a316637bffc98eca1c

                    SHA512

                    1fa026e8de0dc5f94c2653ed96d9549f86ae30351a9d22a2b61ef51b54853fa46628015872b83f003f1afdc8fa28a4faba94c83d0e7d09b97e1ea96631498503

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3240745.exe

                    Filesize

                    940KB

                    MD5

                    a72f658ad111585512f5875b2bf45e7a

                    SHA1

                    584e4ca7a9fbf45a4423ae4c49e31cf948288fa0

                    SHA256

                    fbf17ed9d02031d43db98e29bbe2382981318f78a43a643fd8cd7053a3f607b3

                    SHA512

                    4e3f905db6e77a39f52d7ae3a0cb88c7d02b27e9ba84ae757a65e5765b18873c4cffd2086ebbf981ac1bc27085b59755cc130da3ee50e033cd10b8f7ed13f124

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3240745.exe

                    Filesize

                    940KB

                    MD5

                    a72f658ad111585512f5875b2bf45e7a

                    SHA1

                    584e4ca7a9fbf45a4423ae4c49e31cf948288fa0

                    SHA256

                    fbf17ed9d02031d43db98e29bbe2382981318f78a43a643fd8cd7053a3f607b3

                    SHA512

                    4e3f905db6e77a39f52d7ae3a0cb88c7d02b27e9ba84ae757a65e5765b18873c4cffd2086ebbf981ac1bc27085b59755cc130da3ee50e033cd10b8f7ed13f124

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e4075088.exe

                    Filesize

                    174KB

                    MD5

                    f0c41ff6576b8558e2d97dc17cbb7e4c

                    SHA1

                    d6963006cd411347c87a29042d98978218998808

                    SHA256

                    0ffa0b7762dc94d00d31490dca5355a14eeb0b79d032908e95aa6d1294665530

                    SHA512

                    f542812c49d3ef59007979f8efb621138da0dfbc7627ad0bd421a3da2f88cf517277a14a6d96931e6d2453b095dc41dc3a75683b9d0cb4afc97828a536dc6fda

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e4075088.exe

                    Filesize

                    174KB

                    MD5

                    f0c41ff6576b8558e2d97dc17cbb7e4c

                    SHA1

                    d6963006cd411347c87a29042d98978218998808

                    SHA256

                    0ffa0b7762dc94d00d31490dca5355a14eeb0b79d032908e95aa6d1294665530

                    SHA512

                    f542812c49d3ef59007979f8efb621138da0dfbc7627ad0bd421a3da2f88cf517277a14a6d96931e6d2453b095dc41dc3a75683b9d0cb4afc97828a536dc6fda

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8778165.exe

                    Filesize

                    783KB

                    MD5

                    929d876cf0c3b56674907609cf07b14e

                    SHA1

                    27797962256921580a1c34ad8c3b0338d4e82d10

                    SHA256

                    90cbf738a6f2f30ec4115e8c84b65dea10a15d9b51176244a025081a47293b9a

                    SHA512

                    d8691844b4287f739724b02f340d60e16a9cda9aad21bd35944eae0fdae367f6b65483d1d93d9cdbd54f4f2d4b9299f34bebd5782192913e9d6cd0e363f4dbd8

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8778165.exe

                    Filesize

                    783KB

                    MD5

                    929d876cf0c3b56674907609cf07b14e

                    SHA1

                    27797962256921580a1c34ad8c3b0338d4e82d10

                    SHA256

                    90cbf738a6f2f30ec4115e8c84b65dea10a15d9b51176244a025081a47293b9a

                    SHA512

                    d8691844b4287f739724b02f340d60e16a9cda9aad21bd35944eae0fdae367f6b65483d1d93d9cdbd54f4f2d4b9299f34bebd5782192913e9d6cd0e363f4dbd8

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d8628052.exe

                    Filesize

                    140KB

                    MD5

                    6862de84e2a2191bcbb53c6623e7f6ee

                    SHA1

                    510920373c642a207b846619eb8b9d800ff1bf6d

                    SHA256

                    bd2b410d5db5b93fa2b01739fc8e3606c30fa4b53691cd6ff6122c6281148c7b

                    SHA512

                    6ab1aa31e8779040c4d5905d412125a0c496ee02f87d0747f6ab7688b9f69137b55b5dd74b749646002ddeabb7807c2f2f1c6c94d64483fa26ed2b62a45cfc67

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d8628052.exe

                    Filesize

                    140KB

                    MD5

                    6862de84e2a2191bcbb53c6623e7f6ee

                    SHA1

                    510920373c642a207b846619eb8b9d800ff1bf6d

                    SHA256

                    bd2b410d5db5b93fa2b01739fc8e3606c30fa4b53691cd6ff6122c6281148c7b

                    SHA512

                    6ab1aa31e8779040c4d5905d412125a0c496ee02f87d0747f6ab7688b9f69137b55b5dd74b749646002ddeabb7807c2f2f1c6c94d64483fa26ed2b62a45cfc67

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4832149.exe

                    Filesize

                    617KB

                    MD5

                    f05e6534a88b122052d2aa9e8e2025d8

                    SHA1

                    75274d3650a4b69dbd5f74eede914b511d327b9e

                    SHA256

                    d19bd34593d6d29a2cbac6a829cc23a3e587951aa3f041920369a8e038d1c256

                    SHA512

                    c0cb03d5dba73e67f0e572d012eea39c28fdf460631f5704c130b36fd9d238425844dd8b1bd4c3c8fb8e82f19925e6b526472dc5bb27a08d973ee95154787498

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4832149.exe

                    Filesize

                    617KB

                    MD5

                    f05e6534a88b122052d2aa9e8e2025d8

                    SHA1

                    75274d3650a4b69dbd5f74eede914b511d327b9e

                    SHA256

                    d19bd34593d6d29a2cbac6a829cc23a3e587951aa3f041920369a8e038d1c256

                    SHA512

                    c0cb03d5dba73e67f0e572d012eea39c28fdf460631f5704c130b36fd9d238425844dd8b1bd4c3c8fb8e82f19925e6b526472dc5bb27a08d973ee95154787498

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c1532064.exe

                    Filesize

                    398KB

                    MD5

                    194c760f25361d0a4973696ef488509c

                    SHA1

                    48bcd81ea129d19ba3bcd030b09b4ce1f6587b4c

                    SHA256

                    0fe30661badd75dfe24a740099f432833164ee055ee4694dc1f3d4b15ee63381

                    SHA512

                    bfa7179cdd428d72557c2699a8596b44b8032d27a0dbcf37d9cbf6efef403caef07eb9fe2262200bec5d2c490d95d8c92e70f4c6b2c24cd837c798858bd43fce

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c1532064.exe

                    Filesize

                    398KB

                    MD5

                    194c760f25361d0a4973696ef488509c

                    SHA1

                    48bcd81ea129d19ba3bcd030b09b4ce1f6587b4c

                    SHA256

                    0fe30661badd75dfe24a740099f432833164ee055ee4694dc1f3d4b15ee63381

                    SHA512

                    bfa7179cdd428d72557c2699a8596b44b8032d27a0dbcf37d9cbf6efef403caef07eb9fe2262200bec5d2c490d95d8c92e70f4c6b2c24cd837c798858bd43fce

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5187228.exe

                    Filesize

                    346KB

                    MD5

                    471ce1b7a958a2d915d15d41fd1cde86

                    SHA1

                    2a97a1c2ff3637e958f242eac5e1c3d4a2835c9f

                    SHA256

                    d7475bc4fec8a51eb93e1903d63358dba2fc937a8b74fe86dcf4fbf02f7346aa

                    SHA512

                    d0956d478a94179a23115547ce60e297dfdcb8bf2a69dcac7d39772514426403aec9a43c79dd8567c4461c435b1190d289ac5d726f701afd08cfa33d11bd17e0

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5187228.exe

                    Filesize

                    346KB

                    MD5

                    471ce1b7a958a2d915d15d41fd1cde86

                    SHA1

                    2a97a1c2ff3637e958f242eac5e1c3d4a2835c9f

                    SHA256

                    d7475bc4fec8a51eb93e1903d63358dba2fc937a8b74fe86dcf4fbf02f7346aa

                    SHA512

                    d0956d478a94179a23115547ce60e297dfdcb8bf2a69dcac7d39772514426403aec9a43c79dd8567c4461c435b1190d289ac5d726f701afd08cfa33d11bd17e0

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7101377.exe

                    Filesize

                    235KB

                    MD5

                    4ab2e32ecdb1ccc92170c61582dc4aea

                    SHA1

                    4a235e9d21b26a0cbc5f54379359c28acfe8f94d

                    SHA256

                    cdbaeedcb75f6ee1890390191f9be412b828f7d8ed362c4302ebd33ce9eaf033

                    SHA512

                    e2d967fa55d5be12c380fcbda527297f8630f4c708f90899ad8c484db07201d8e0fa73c095c5e83fb4234b2b61620c85236bf99a44187fb84d84e8d97615ded0

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7101377.exe

                    Filesize

                    235KB

                    MD5

                    4ab2e32ecdb1ccc92170c61582dc4aea

                    SHA1

                    4a235e9d21b26a0cbc5f54379359c28acfe8f94d

                    SHA256

                    cdbaeedcb75f6ee1890390191f9be412b828f7d8ed362c4302ebd33ce9eaf033

                    SHA512

                    e2d967fa55d5be12c380fcbda527297f8630f4c708f90899ad8c484db07201d8e0fa73c095c5e83fb4234b2b61620c85236bf99a44187fb84d84e8d97615ded0

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3953895.exe

                    Filesize

                    364KB

                    MD5

                    437b0e8e1d0c59955598e0c88cb302d8

                    SHA1

                    dd7e8098327016f4eeabd4b33727299418db08f1

                    SHA256

                    2415fa31dacf344b0640033e8f21c9412d8fddec0d68d25b5031458c1ec4369c

                    SHA512

                    7a9b8e157a9bdcce733aaa4796a084699eeb365736804d82c62e4622cb9a96d61cf074834e77a34180d8f614f0401e535959fedd4362cd584261b3a50737f788

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3953895.exe

                    Filesize

                    364KB

                    MD5

                    437b0e8e1d0c59955598e0c88cb302d8

                    SHA1

                    dd7e8098327016f4eeabd4b33727299418db08f1

                    SHA256

                    2415fa31dacf344b0640033e8f21c9412d8fddec0d68d25b5031458c1ec4369c

                    SHA512

                    7a9b8e157a9bdcce733aaa4796a084699eeb365736804d82c62e4622cb9a96d61cf074834e77a34180d8f614f0401e535959fedd4362cd584261b3a50737f788

                  • memory/2680-67-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2680-69-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2680-42-0x0000000000400000-0x000000000040A000-memory.dmp

                    Filesize

                    40KB

                  • memory/2680-43-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/3940-79-0x00000000057E0000-0x00000000057F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3940-78-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/3940-75-0x0000000003250000-0x0000000003256000-memory.dmp

                    Filesize

                    24KB

                  • memory/3940-74-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/3940-73-0x0000000000F60000-0x0000000000F90000-memory.dmp

                    Filesize

                    192KB

                  • memory/4564-65-0x0000000005380000-0x00000000053BC000-memory.dmp

                    Filesize

                    240KB

                  • memory/4564-57-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/4564-55-0x0000000000400000-0x0000000000430000-memory.dmp

                    Filesize

                    192KB

                  • memory/4564-66-0x00000000053C0000-0x000000000540C000-memory.dmp

                    Filesize

                    304KB

                  • memory/4564-56-0x00000000012C0000-0x00000000012C6000-memory.dmp

                    Filesize

                    24KB

                  • memory/4564-64-0x0000000005230000-0x0000000005240000-memory.dmp

                    Filesize

                    64KB

                  • memory/4564-62-0x0000000005450000-0x000000000555A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4564-61-0x0000000005960000-0x0000000005F78000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4564-77-0x0000000005230000-0x0000000005240000-memory.dmp

                    Filesize

                    64KB

                  • memory/4564-76-0x0000000073F00000-0x00000000746B0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/4564-63-0x00000000051F0000-0x0000000005202000-memory.dmp

                    Filesize

                    72KB

                  • memory/5080-49-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/5080-48-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/5080-47-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/5080-51-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB