Analysis

  • max time kernel
    45s
  • max time network
    46s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 18:58

General

  • Target

    Roblox Account Manager.exe

  • Size

    5.4MB

  • MD5

    334728f32a1144c893fdffc579a7709b

  • SHA1

    97d2eb634d45841c1453749acb911ce1303196c0

  • SHA256

    be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

  • SHA512

    5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

  • SSDEEP

    98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\Temp\{A5673C36-8CE1-4F9E-88AC-DA3B68673B73}\.cr\vcredist.tmp
          "C:\Windows\Temp\{A5673C36-8CE1-4F9E-88AC-DA3B68673B73}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9A8FAFE9-2048-4AA6-BC7D-D6D91F103C54} {349907A8-497E-4A98-9CB0-E0247F4C065F} 3708
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2684
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D3388C1E-F793-42EC-A0C3-BE2521B056DD} {1B68CBD8-8786-44AA-A526-46BA0A3BBFE3} 2684
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4572
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D3388C1E-F793-42EC-A0C3-BE2521B056DD} {1B68CBD8-8786-44AA-A526-46BA0A3BBFE3} 2684
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3828
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4E339662-FF8B-45C4-B2B3-5A877E8331AC} {54DB1252-6682-4A51-A77D-F4B633365CDF} 3828
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:5024
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3984
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4556
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e5804e2.rbs

      Filesize

      16KB

      MD5

      eba91d1051392eed50ea8615e38f7bce

      SHA1

      02d8ba8d82570da3efe5411a662665358096194d

      SHA256

      7f13905ae608dd776c23848162c17d54e6a3685791c6586d466b831cab61540f

      SHA512

      254f73e49478411cac8731b572813f94e26d4589ac911d9d1357c6f93c9c2b99d65b3effb2a74bb076d85bbc43a292212722af0aa8ff40c7ff84f7b7baf29d36

    • C:\Config.Msi\e5804e7.rbs

      Filesize

      18KB

      MD5

      ed1d2c88ce86a3b69ffc753b44f022dc

      SHA1

      e863f5ec37b050e5f4c2c3e95ef4b852cb9e3dd7

      SHA256

      012e2c927264d01f4bb94efb3ea6a9da2061a606316a274c8c75f395d1ff25af

      SHA512

      23bea0657da6b20c55ef5b6ffec9315e11517c4c875306e5789dfb2c72bdd0379ae6aff3e54c3c6b3702f10ba32730cf8057c139c8d163a7831f1a7868893720

    • C:\Config.Msi\e5804f4.rbs

      Filesize

      20KB

      MD5

      18a8b5870e62bcf29feca977815fd4d3

      SHA1

      ca053a915824dfcc6f6b4f701288b903217c3321

      SHA256

      26591603742a2685916f64030b9396756d212b77ddadb518c4f314665824a845

      SHA512

      8dbd5b51435a23eb582fb5dbbd7d17744ac36715ce47d76195565a77dc98d6f781a09bf9d0814f01b608c05d3b07a88b06cd1d1346e163a144079cc0e7c6e4b5

    • C:\Config.Msi\e580503.rbs

      Filesize

      19KB

      MD5

      6ad131228617e5361dd62da1883ef5a9

      SHA1

      0f062d17e4f18ed38eaf1301087047215afc4c3d

      SHA256

      c209bec3a939643a9848a0d9c42941b6efbb1bd971454b0f31b69c0fb67b67b5

      SHA512

      f295cf10dfdf136927cb9592da872c2dbb1485aedfd0f5005d00b585a5c6506f02868c451a7fb4ff944f0d6c2cba273cc0ba636b3736d338da3efcfc811b9ca4

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

      Filesize

      1KB

      MD5

      a02e8a8a790f0e0861e3b6b0dbe56062

      SHA1

      a3e65805e5c78641cafebc1052906d7350da9d2e

      SHA256

      7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

      SHA512

      108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

    • C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

      Filesize

      1014B

      MD5

      1d917eaf5dcc8e06dd032c33f3a3d36a

      SHA1

      1eacb4eced22393fd5140910d30070f2e054e2fe

      SHA256

      787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f

      SHA512

      3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd

    • C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

      Filesize

      314B

      MD5

      f18fa783f4d27e35e54e54417334bfb4

      SHA1

      94511cdf37213bebdaf42a6140c9fe5be8eb07ba

      SHA256

      563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

      SHA512

      602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

      Filesize

      6KB

      MD5

      0a86fa27d09e26491dbbb4fe27f4b410

      SHA1

      63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

      SHA256

      2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

      SHA512

      fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241113185840_000_vcRuntimeMinimum_x86.log

      Filesize

      2KB

      MD5

      9a1dc6daa8c48aa9e8685d0606a4670b

      SHA1

      c4b018bf0b67df434c9f19ff354f367223129d1c

      SHA256

      620c8e665241626f8e718d07ef7aa387d6d3ea2e5be09cc8cd277701b2befaf0

      SHA512

      519cc0425a6b81a638321327123ca483bede7f30d300082e75ca0fb8208e8dd7fc6cee996fba73d02b4242ffcf2b7034893b141ccce16dc8ed40ffc62c1bce76

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241113185840_001_vcRuntimeAdditional_x86.log

      Filesize

      2KB

      MD5

      e0ae1f45f01225700de95f9a7c349ad8

      SHA1

      bc16f0659a66544a11e4b263536255e24eb00696

      SHA256

      7e6f5778b44e0eecdbf43ab456a4eed69ef268c77ec49770127d77d68469ba0a

      SHA512

      f0104a6df2ab25ef124cc4892ddf796366426f109710d23008404d35051f7a73a0a1d773ce60b91f35cd7f7de4dde2126da636116e45354423a3209e28c541de

    • C:\Users\Admin\AppData\Local\Temp\log4.config

      Filesize

      936B

      MD5

      e4659ac08af3582a23f38bf6c562f841

      SHA1

      19cb4f014ba96285fa1798f008deabce632c7e76

      SHA256

      e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

      SHA512

      5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

    • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

      Filesize

      13.3MB

      MD5

      8a6f4f3282236325360a9ac4413b7bc3

      SHA1

      cb617803813e969be73f2e0e175a67620e53aa59

      SHA256

      dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

      SHA512

      2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

    • C:\Windows\Temp\{90783B29-B416-4509-8278-0773C0ACF7C3}\.ba\wixstdba.dll

      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

    • C:\Windows\Temp\{A5673C36-8CE1-4F9E-88AC-DA3B68673B73}\.cr\vcredist.tmp

      Filesize

      669KB

      MD5

      f7aca1ef43beaa02107214482e6b51d6

      SHA1

      fb5cec36519b148119dec501cec92d894eb3b60a

      SHA256

      169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

      SHA512

      82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\.ba\logo.png

      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\.ba\wixstdba.dll

      Filesize

      215KB

      MD5

      f68f43f809840328f4e993a54b0d5e62

      SHA1

      01da48ce6c81df4835b4c2eca7e1d447be893d39

      SHA256

      e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

      SHA512

      a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\cab54A5CABBE7274D8A22EB58060AAB7623

      Filesize

      842KB

      MD5

      a04f3e3bd8684cf660619e0f6af4d751

      SHA1

      2b5b1a39de1faa20d9a5774ec7b27dee5f6fc065

      SHA256

      b31b87a09f3aa2df573050949e87a68eeda01cb80dc974714d0603cea2c0708b

      SHA512

      fb3c081ad9f23661ed6f167ca878469d702f5cb60c15bb6d04c21331b43f8b88d98a680ad74ff5855e4c286260452be9e25b49b5b245d14fa30297cc8add5828

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\cabB3E1576D1FEFBB979E13B1A5379E0B16

      Filesize

      4.9MB

      MD5

      654f67c3c99d57a0008427141bd1cfc6

      SHA1

      60887d57c8910a5034379ddc7a0ad5e2c2bfcde6

      SHA256

      d87d9b997b91f9e375bf3cf994b67882ce21c0fbd4d0c4611dd6f593d4a8f3be

      SHA512

      0f3182a9c923a51f9ffed2e8639f9bcb72ace859c6253aa860a95c2c67c6b9d80d7945042460a7f73e357614b149c9d906c101f800724825279f07902571a064

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\vcRuntimeAdditional_x86

      Filesize

      200KB

      MD5

      95715c58dd2864b361dbd9e651b2f5ad

      SHA1

      c8b19282b7950e7b8e106b5bbccad4fc7b3aa661

      SHA256

      a6447de0d0d5b56b50988ae350432d68e9d83fbb566e2fcaa3f758a2b2574fea

      SHA512

      10eb258d1c1ab690e03fd782316133305530a7a50769263176765862a754dcf5ec258ca5805d2be447a53b29b3557b519a6cec812208d88982201c86ea8d5fb3

    • C:\Windows\Temp\{FC8745A0-4A6B-4962-BBF3-207B1E941C3B}\vcRuntimeMinimum_x86

      Filesize

      200KB

      MD5

      975e07089d93c2540f0e91da7e1e0142

      SHA1

      e65a155b9f88cabf6fc34111751051f8872f1dc2

      SHA256

      16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

      SHA512

      047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

    • memory/2356-15-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/2356-0-0x000000007488E000-0x000000007488F000-memory.dmp

      Filesize

      4KB

    • memory/2356-1-0x0000000000B40000-0x00000000010AC000-memory.dmp

      Filesize

      5.4MB

    • memory/2356-2-0x0000000006070000-0x0000000006614000-memory.dmp

      Filesize

      5.6MB

    • memory/2356-3-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/2356-4-0x0000000005A20000-0x0000000005A66000-memory.dmp

      Filesize

      280KB

    • memory/2356-5-0x0000000005B70000-0x0000000005C02000-memory.dmp

      Filesize

      584KB

    • memory/2356-6-0x0000000005AD0000-0x0000000005AF6000-memory.dmp

      Filesize

      152KB

    • memory/2356-7-0x0000000005B10000-0x0000000005B2E000-memory.dmp

      Filesize

      120KB

    • memory/2356-14-0x000000007488E000-0x000000007488F000-memory.dmp

      Filesize

      4KB

    • memory/3572-35-0x000000000DD60000-0x000000000DD82000-memory.dmp

      Filesize

      136KB

    • memory/3572-26-0x000000000C250000-0x000000000C25A000-memory.dmp

      Filesize

      40KB

    • memory/3572-21-0x0000000006880000-0x000000000688A000-memory.dmp

      Filesize

      40KB

    • memory/3572-20-0x00000000066D0000-0x0000000006744000-memory.dmp

      Filesize

      464KB

    • memory/3572-101-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-102-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-103-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-104-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-17-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-24-0x000000000B520000-0x000000000B55A000-memory.dmp

      Filesize

      232KB

    • memory/3572-16-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-23-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-36-0x000000000DD90000-0x000000000DE84000-memory.dmp

      Filesize

      976KB

    • memory/3572-38-0x000000000DEB0000-0x000000000DEB8000-memory.dmp

      Filesize

      32KB

    • memory/3572-37-0x000000000DE80000-0x000000000DE9A000-memory.dmp

      Filesize

      104KB

    • memory/3572-34-0x000000000DC80000-0x000000000DD32000-memory.dmp

      Filesize

      712KB

    • memory/3572-25-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3572-32-0x000000000DAD0000-0x000000000DB28000-memory.dmp

      Filesize

      352KB

    • memory/3572-196-0x0000000005290000-0x000000000529A000-memory.dmp

      Filesize

      40KB

    • memory/3572-197-0x000000000C920000-0x000000000C932000-memory.dmp

      Filesize

      72KB

    • memory/3572-27-0x000000000C3A0000-0x000000000C440000-memory.dmp

      Filesize

      640KB

    • memory/3828-297-0x0000000000D70000-0x0000000000DE7000-memory.dmp

      Filesize

      476KB

    • memory/4572-298-0x0000000000D70000-0x0000000000DE7000-memory.dmp

      Filesize

      476KB

    • memory/5024-260-0x0000000000D70000-0x0000000000DE7000-memory.dmp

      Filesize

      476KB