Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2023 09:00

General

  • Target

    Roblox-UWP-Executor-main/XYZ.exe

  • Size

    3.1MB

  • MD5

    6798986718c9d923ae747ff1bed1a16f

  • SHA1

    dbf6ebb0b412286ec6007409f15d20c90038528b

  • SHA256

    aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

  • SHA512

    07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

  • SSDEEP

    49152:yvdt62XlaSFNWPjljiFa2RoUYI8lCtBeiLoG/pTHHB72eh2NT:yvf62XlaSFNWPjljiFXRoUYIuCF

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

smirkdns.ddns.net:4782

Mutex

45259779-0dcb-4afe-a014-ae49cf73286e

Attributes
  • encryption_key

    38F8A837013773F52CA41CD4456A32A9B17A9557

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    AustiBlox

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 10 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox-UWP-Executor-main\XYZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox-UWP-Executor-main\XYZ.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VslMXHUFP8MW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:3048
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:4636
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3628
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EUbZr62u4fH8.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4432
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:4652
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:3412
                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2176
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\95DwxjQWzS6q.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:992
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:2144
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:4256
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4780
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASx26qw3YFNg.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1688
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:4436
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:3324
                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3856
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OitPqrQhFpMK.bat" "
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4236
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:1492
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • Runs ping.exe
                                    PID:4376
                                  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:1072
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RrBrvqLsSyD1.bat" "
                                      13⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2240
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        14⤵
                                          PID:4908
                                        • C:\Windows\system32\PING.EXE
                                          ping -n 10 localhost
                                          14⤵
                                          • Runs ping.exe
                                          PID:4896
                                        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1580
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3f0T6kqnoMvV.bat" "
                                            15⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:3044
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              16⤵
                                                PID:4940
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                16⤵
                                                • Runs ping.exe
                                                PID:1964
                                              • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                16⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3908

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

                  Filesize

                  2KB

                  MD5

                  8f0271a63446aef01cf2bfc7b7c7976b

                  SHA1

                  b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

                  SHA256

                  da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

                  SHA512

                  78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

                • C:\Users\Admin\AppData\Local\Temp\3f0T6kqnoMvV.bat

                  Filesize

                  207B

                  MD5

                  4a3d96d1f424657969e3f606b8f3c7ab

                  SHA1

                  2b7f6bc7b313025fa7568e3903f5329edd74e4f9

                  SHA256

                  9ce5f5c5c9d724cdd06f05342705bbc4ba4ffca832d4ac6702c52074e42479f6

                  SHA512

                  cc5bf92eed12fef5d89074210f71ae75e25c85f0780d346d4fe09fd50324bce510d62deb9a31c88b4d057914048d81be833e5bc050dabada9b570c6966f9cb08

                • C:\Users\Admin\AppData\Local\Temp\95DwxjQWzS6q.bat

                  Filesize

                  207B

                  MD5

                  95b07f5fbf1e1ae8cadac796da712432

                  SHA1

                  0995664a15117df4b65397dd3b549802a26d0d7c

                  SHA256

                  dd0375528450e7f74e9b59d7d38a96ad4f4ded5b0d4818c709918a83ef67459c

                  SHA512

                  215917246780cbbdf48cc946e4f3962ff1a65e724e84bd7cb4899874fc7f23ccca924bb20bd9bc975d29d1a2dc9202cf4b86727e488e9a17b46f9e50918d3d65

                • C:\Users\Admin\AppData\Local\Temp\ASx26qw3YFNg.bat

                  Filesize

                  207B

                  MD5

                  0df84c4484bfb7ed859ecd548fdf2a37

                  SHA1

                  c9a3a7c8098a65bac5164fecee61b350b94672c4

                  SHA256

                  4af39f934da9b54cbc077db29b736295fd1e936491e91dbcad48ecd2da4506c2

                  SHA512

                  b59967431a5b5cb8d998f981840d44e5aec54c690b76e9b5b845cca2606836273e9c4887469d7f8b9e79bc0bfe03811cc95ec6cba704a6be279f43021f420374

                • C:\Users\Admin\AppData\Local\Temp\EUbZr62u4fH8.bat

                  Filesize

                  207B

                  MD5

                  da315cfd7b6dda98000aaaf06b85b37d

                  SHA1

                  8b181aba949be8d5ea62c1e53a892c62e824b129

                  SHA256

                  5f84929f55ce11edb4583f1a9de3ab4f44feaf43344bc5b5fec102592775e02a

                  SHA512

                  8702c92357f3368a3c95676fb5da6415fafbf7f5a56380b728aea728c9b81d727a24bf1937692599142d277b33bcaca23b0205cd748797a1f2fda0e5d9f463b2

                • C:\Users\Admin\AppData\Local\Temp\OitPqrQhFpMK.bat

                  Filesize

                  207B

                  MD5

                  0b1a4d8b04d511216c5ea2e9c72a0e7d

                  SHA1

                  741fa51a0e066a053d3e540a5f3a230cf77e6c3f

                  SHA256

                  803654c3a4fa3de2207737ecf610d0153d7f069f8f37de0d046bdc537a85a33e

                  SHA512

                  11462002d9881b0de5262a409333bcdb9c8e7c27b9faa9867a9f9f4591344846e470caeadb450ee68899ad70ed012d00ade15bc9503ffd152f2da4934f5b7262

                • C:\Users\Admin\AppData\Local\Temp\RrBrvqLsSyD1.bat

                  Filesize

                  207B

                  MD5

                  dcab9d1b117db7ea162f0a5c4f7e8dcf

                  SHA1

                  e19504546b6696e74933c70f1df8f4fc2a370ec9

                  SHA256

                  49b0707b145c6ea652026092613e59e5dacf7e333414c2ab81bb97833e41fc37

                  SHA512

                  937fc316dd7ba08c28bfbf2dbe70b5fa133cc3a98a0ca1ec0591a8ad35e552c9156c96d5051909a3d3ef93d0fc0bf3954a328023f62d9e22a9f1854c4d7d175f

                • C:\Users\Admin\AppData\Local\Temp\VslMXHUFP8MW.bat

                  Filesize

                  207B

                  MD5

                  373a71ac3eb4d183a9cf55209df4972e

                  SHA1

                  4629cddbddf39236f9c1d3c84e44f72cc78d75db

                  SHA256

                  a999556e9ee454cbd6893f86f99d02f77266fb9d874187df5ff0e3ee7994f6b2

                  SHA512

                  e9e5213e044b305a931731c5b5359f2830f79e5891ea410c84338cc6aa20d6b95bd2dd65557cf9b76471eeff16064a377a1ff4a29ed38f3cceee1f1d67c27cab

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                  Filesize

                  3.1MB

                  MD5

                  6798986718c9d923ae747ff1bed1a16f

                  SHA1

                  dbf6ebb0b412286ec6007409f15d20c90038528b

                  SHA256

                  aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                  SHA512

                  07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                • memory/1072-54-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1072-55-0x00000000018F0000-0x0000000001900000-memory.dmp

                  Filesize

                  64KB

                • memory/1072-59-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1580-62-0x00007FF86A850000-0x00007FF86B311000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1580-63-0x000000001B820000-0x000000001B830000-memory.dmp

                  Filesize

                  64KB

                • memory/1580-67-0x00007FF86A850000-0x00007FF86B311000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2176-30-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2176-31-0x0000000001620000-0x0000000001630000-memory.dmp

                  Filesize

                  64KB

                • memory/2176-35-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2392-10-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2392-12-0x000000001C480000-0x000000001C4D0000-memory.dmp

                  Filesize

                  320KB

                • memory/2392-13-0x000000001C590000-0x000000001C642000-memory.dmp

                  Filesize

                  712KB

                • memory/2392-18-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2392-11-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3628-27-0x00007FF86A360000-0x00007FF86AE21000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3628-23-0x000000001BD90000-0x000000001BDA0000-memory.dmp

                  Filesize

                  64KB

                • memory/3628-22-0x00007FF86A360000-0x00007FF86AE21000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3856-46-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3856-51-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3856-47-0x000000001B9F0000-0x000000001BA00000-memory.dmp

                  Filesize

                  64KB

                • memory/3908-70-0x00007FF86A850000-0x00007FF86B311000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3908-71-0x0000000003160000-0x0000000003170000-memory.dmp

                  Filesize

                  64KB

                • memory/4272-2-0x000000001B360000-0x000000001B370000-memory.dmp

                  Filesize

                  64KB

                • memory/4272-9-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4272-0-0x0000000000480000-0x00000000007A4000-memory.dmp

                  Filesize

                  3.1MB

                • memory/4272-1-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4780-44-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4780-38-0x00007FF86A690000-0x00007FF86B151000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4780-39-0x0000000000EF0000-0x0000000000F00000-memory.dmp

                  Filesize

                  64KB