Analysis

  • max time kernel
    430s
  • max time network
    436s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 13:35

General

  • Target

    StarsVaders.exe

  • Size

    177.5MB

  • MD5

    55e8f15927fc3ccb2e220f6ad8a4585a

  • SHA1

    2e07f1b4dd8c137afb687b9b539b395786792a8e

  • SHA256

    cf2b063cb5f385bf7a9042039e862400ec30dabc18aeaf96b633f53f4357657d

  • SHA512

    3b0c502b0eedabadb72fe716fc11e3669f38c40194f9fd5ba3d7b7449a059ee658774bf7b595a81e172131677b6d4d78e8f65e1c64f8d64c88a7b38d7fe6b396

  • SSDEEP

    1572864:F6SlyW//ASwc0eKrtjR3QelIHvSfIc7ro6f1cVYc+lj3PVXaC2DPLTCncMHzNHt9:g4KZxQrFQl

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to get system information.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe
    "C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe
      "C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\StarsVaders" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1736,i,13596593642687369767,1540847115950175215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      2⤵
        PID:4044
      • C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe
        "C:\Users\Admin\AppData\Local\Temp\StarsVaders.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\StarsVaders" --field-trial-handle=1932,i,13596593642687369767,1540847115950175215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:3
        2⤵
          PID:64
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4980
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4572
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:528
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3012
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1220
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4380
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1628

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              3KB

              MD5

              3bfc414667e1ebc31e9259fa1db290fa

              SHA1

              9bff989429779efef334e5524a362e7b6ff266cb

              SHA256

              b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab

              SHA512

              e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              6f93ba2bf86c51621ed901d5066fb2c8

              SHA1

              c476f6080fb1db89c755757e9a2586206ff33491

              SHA256

              c9730d10fd39a556bc3134350c8e06e4126abe61ee41cc5cd6927eab4037143f

              SHA512

              ce6a78e697ef8510e39eb113df1dfaf68f714c2d2278e346e58a779e7861287a229ea26b433611db26aa12614405af0c2c13b4ab5041db76f8a5673564512401

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              3d1eddf3cb40acf2f5e1be5c25e1b51f

              SHA1

              1dc89bcd99396f93e57f84309fba29947556c392

              SHA256

              376fb90a48e5e18ff1aa366166d2b2f1a778d5a2dbb210edb1d00165bb9dd1b1

              SHA512

              7037ee98b5d3e2dc288640e63d97bff0eb2ae3114fb03a0e4731249b28245b81b1d3e13245c74b12b3463eef98b188d721c1738ad1a2781148819b22202878bf

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              7b1683dbdd3c27f396bfe818a92697a2

              SHA1

              edc7f55af593daa0b96a9ceb5991b730e8098a7b

              SHA256

              7b704b5f34be517553f3548f7faa1d70b82912a7c6e33ffb8ac50951cee614c8

              SHA512

              4c28554f9e87eb0deb154ba849083b92ba29b07e01fc87f7fff4848c9df05882f14e66b0712b1d513da6c502df379ea25b5573f2e579e823fb62f2debc9dca76

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              e106d8a9672b7f06024151a6f900d910

              SHA1

              2bb94303682c470e93cc4e8cf56f2ac002f622de

              SHA256

              143f69cf71c638efe881379dc6810c4bd97492a49cbd93dca38562deceb3b7f5

              SHA512

              8cf484bd5c0a96db32163bdbc747206de490e03ec988363548197c5cfaade28e3193bbc253123a860c9ed4852fa7f3709716def1718339c0fdd3bfe40fef5f2a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              3a33adfdca63969d9b3a626213a17e29

              SHA1

              50e68a0edefad493e31c3a8fa1aad5b40677aea2

              SHA256

              4b0606ec204fe2b6fc5ec9e334bfadb9caf3174f9aad8a680538675e5f48a02f

              SHA512

              b8af33fd87e3093d5c097a03f13a448ed2ba7aeb56cf53d3784e92ef600444a41182ed064a59849eb43417249acdbb7ca16592a86d57db76807ecaa7a9785186

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              4a1ecdb31d7a3d9699351208166883cb

              SHA1

              b62a03b1a9e94f731427b5e19bd57bbc4a53e742

              SHA256

              6fa9e2383011bb63b475b42dbc83c1e1db57135ac2590bec0a9003e7f036eeb7

              SHA512

              ec94fd098e3c3674eb2fd6704414d179f1ac118c566f0b57be40050f3688e5b60bd6fd528631e827058b49f25d74d1f6f939a9c4c1ad9e0256534a83d8b491b6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              d576edc3ba971ac7fd8898dfac4c22ea

              SHA1

              7e14adf3e579216711951a51414ac8a36efc46c4

              SHA256

              e7f68c798d5a3992b404a3b800df98b23ceb63054dbd3d049d48bb9c29400d06

              SHA512

              af314bf572c62d2bb7f0041d4adba8697903359384a25d6b08e01aee6bd63e9abb331ee9655471c6966ac621ba377b2c59274b5d6fcbbd7fcdc7487c77e86c86

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              d3b339b76f0d340549370646476aeffd

              SHA1

              306c50dedb99ac3c42cce60d2a082749c782d3ca

              SHA256

              7c57d57a1956afbfb557a4a7014c3bcd776f4fcf7e29a2def7c4c6396c887bae

              SHA512

              f8b49fb771aa5104c4aa8b779df80425bd7b8e875db8b53b34968f1d5dc500e0679df5833e5a396d172ba098afbbb15297fdd00ea1468db98302fe6a718aa370

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              740951544b69d9a5a00aa693bf1e2d73

              SHA1

              c46fdae6979a08b5e9db05046686f0d1edf38caa

              SHA256

              dd63d617a9607de67ecf702ea93f02e805d11eafbd2c6e9f705c620b1e685a22

              SHA512

              e5fbfb1346aa56c358b6970e0caddb424ef416daba7ed3a2014dc18dabd2d0d5ec42f4a10518ca1453e7dc4da1893ee23b0cd18d4e91887637ce5ae9577db398

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              94ee0ce1b0324062983339c924e9c53c

              SHA1

              a63877ef0ff29db87365b97c3d100d920e49da4c

              SHA256

              14388ad4ba462c786086cc3987c77fd8c78e86f88775691868209ccd53d98446

              SHA512

              4e9168e89fa4b72c9a72dd2f974113bd477e9bc3de72133e89121675ecd54a66135dea71675166e2f637d8d5c7db36ef8c6ef5c795663bf04ec2034acdc462e5

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              7d62a8b4882bcae55db635f5173a97d9

              SHA1

              c780200e6e77abadbf872d9493d362ad1ff9342a

              SHA256

              03a9c1ee1610ac667757db120dfb496c1dfe93fb3fe6e25a3805092d19c3349e

              SHA512

              bf3b4cfec8ecf7010ff261bc5eb5d1ab27be5f4cafd73e9fcf6b65dfb340afb27ff77dd26ddb94f7183cd69ac43281bbb3a4afef34ccc306fdd0ca1950fd61eb

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              139370695d63f7f487e7a412839ec6d5

              SHA1

              b0a640dce5d3fab13e722e02d6d8c1e82abf2ac1

              SHA256

              a1ea1dab0972db3a1b9806ec90036ec0c3a68eac135b2b33db0873cdc5668557

              SHA512

              e04e7c617d17e7ae4814cbf6d6072130aa7e2ca5b434fdcc4efc4e64e28d77960c5be2fbe790a0332cf7522ba26550467a6ad3ea8dde0d689204044007830e9a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              7d6cc7aee08a5073cb2c3e98ad23b26c

              SHA1

              3c6451bd5b1b5d3ab4f7249017957e7fe546ea2f

              SHA256

              ec78f7b03043cb62799bc71a691dd0c0c3bc8813459e958c78e337d6a8199ba1

              SHA512

              879e41ce1ac86564217cbff02e0a8e4a155a35b04123d2c7beb51f884cab92b412e0def8f1c06518308fe5e9d37200764b6611ae74a7bf0870cd655264a339a1

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              5b4980ac71f441d18fca9204eb4c0aa5

              SHA1

              4fb88932d50e644129cd135f994a3e13d8f15610

              SHA256

              b09bc204c360ac6db8fc2098492fe7f7f8df7baa0e8591d2f9a51a3778d05ae0

              SHA512

              c479d4a72a997df97d7dd45c3da825f83c7b148e242669b9fcb6e68a1fd59aee38e06ca83f71ca38762fc84518ac09a0b73f578a3b0709e61bc9f3bda0d523c6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              a3f876345166554eed8fbee8a51a8961

              SHA1

              e87b3b36fd85fe3ec934d2f75f7a923c770aacbc

              SHA256

              d7847d40ff580150d1a7fc13f7102c63bf38e964c78ff13e3f916e22cb3fb398

              SHA512

              9fcedf13969adcb1a94ac4295ace78f5157496cc9789431e28f9e3ae8b58d5b1143a1ef8c31ed71b3a1e4e3ff50bf631c8467336cee3f4405eec08362de9253b

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              371e7ee6c059cbe909fb920a5fbdc79b

              SHA1

              748b6dd17f5fe32b309ff9910e84c77a3f6a8092

              SHA256

              31bd5a28190599cf85382a7a9a438e8cf8dd7897181d9fd270827ea4fb4545ba

              SHA512

              036e660355198776e712c6159c378abb32a2b8fb7335c43bbd80124affc35caa6caabec6f83c9cb7901983efcbf2d658aa68526e62c67ec7eb1460d87ef97f9c

            • C:\Users\Admin\AppData\Local\Temp\9a568e33-7129-4c3d-882a-2dafcbcbcf85.zip

              Filesize

              574B

              MD5

              401df9fb6786041c7a94fd26d88a8e85

              SHA1

              10b7cfd7113f569af3e4a054a909d889927b35b9

              SHA256

              4bc456b62f9767b47957123b961cd831bb5e4b5f090efaf5f5bd1abcfcede363

              SHA512

              f01ad556912c818347bdb9a641ae6bbf5cfe865d30a1cd6e19c37d58feb7ef0fd3cd7b9757a47c14010f9e0fe4c9ecc66216244670585429105ba6d086ec5a54

            • C:\Users\Admin\AppData\Local\Temp\9a568e33-7129-4c3d-882a-2dafcbcbcf85\Cookies\Chrome_Default.txt

              Filesize

              257B

              MD5

              2808a256318fa3d1975d089ac08f7de6

              SHA1

              338b3d96af9dec9d2666ec709c3d587095a260b2

              SHA256

              9dddf07b06d425ba3368d8889a8c519fee8ef8320d25b11f9c03144d96a5e732

              SHA512

              1bad303517077bcda30d5fa5bf541edfdb54d41ef315af7e3056b29f43f97614b93fc881b63bea783445a9a7419c56ce355590157ac7371d5ef7248ceb4ef2f9

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdc0je3t.xqg.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • memory/2644-14-0x00000215514E0000-0x0000021551504000-memory.dmp

              Filesize

              144KB

            • memory/2644-13-0x00000215514E0000-0x000002155150A000-memory.dmp

              Filesize

              168KB

            • memory/2644-9-0x0000021538D50000-0x0000021538D72000-memory.dmp

              Filesize

              136KB