Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2022, 15:45

General

  • Target

    file.exe

  • Size

    803KB

  • MD5

    126a3684f9aeb24f8accf168c8d3ff6f

  • SHA1

    052b826371a6f8879102d304c294a927a6291867

  • SHA256

    52d1dc1fb7fa7726e7527ef2412648ffbc5d78dc7ab551ca4e51078f213b709a

  • SHA512

    11ab5e9123406b2735d59a0695e2477604d1f6d34389eb023f5a1f43ce777c4cbd2797d2f8265a859326b8cec889c72776c383f8f1a074fb97a0fbda0d977d80

  • SSDEEP

    12288:cr1O4SOlacEu1UDEIAtdrPao8lE/XBFwKgYDkT728Jzr0SEazsNunnwcpO:cr1NSO0WaEsliTkfFSewcE

Malware Config

Extracted

Family

djvu

C2

http://winnlinne.com/test3/get.php

Attributes
  • extension

    .ofoq

  • offline_id

    xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://winnlinne.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0568Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.7

Botnet

517

C2

https://t.me/trampapanam

https://nerdculture.de/@yoxhyp

Attributes
  • profile_id

    517

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\c019dd54-c8d1-4cc8-b017-5d2198877b7d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:592
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Users\Admin\AppData\Local\Temp\file.exe
          "C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe
            "C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1608
            • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe
              "C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1156
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" '.198.89.6/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe" & del C:\PrograData\*.dll & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:592
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im build2.exe /f
                  8⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1544
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:1140
          • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe
            "C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:1348
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {A9343F64-EDA6-4794-B959-78E3781A8A22} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
    1⤵
      PID:1940
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:1512
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          3⤵
          • Creates scheduled task(s)
          PID:1824

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

      Filesize

      2KB

      MD5

      5f0a548198075b4cd8c891c5c0f45e4c

      SHA1

      c3dd48a91f5a4dfbecd2a9e5802a8e5d8623aab6

      SHA256

      bcb8d4f0e605ffe557f9f3d23291e2212f39acfa1df9f24331a4075810555839

      SHA512

      8ade693197f9ca350f7c549312de77d70ef362dd3772a9ebb86c30dc7311d047bac0b9e1b517001b4e470271f7f181313f87eeae5b7a71ec5b7be5380525e22f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      60KB

      MD5

      d15aaa7c9be910a9898260767e2490e1

      SHA1

      2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

      SHA256

      f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

      SHA512

      7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

      Filesize

      1KB

      MD5

      cb19ea31ccbd0203dd87e096916c57fa

      SHA1

      cab9da6765c414006fc24a26afe3d9faed3da46c

      SHA256

      f2c2e4c4cb0138ea54016a5b4e248a37f10c3ce22ad3ac85f8509a9692d0394b

      SHA512

      20b5e6d75aa6340e47bb723541ede1ca9a54b8df916e3b9ae6e27ae869dfd13605feb400e0c847974594e126b9852dcb1785f55fc93ba10abcdef93ef71f5b36

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

      Filesize

      488B

      MD5

      c6da45d7e2320beb02953fe1f14600a9

      SHA1

      6c3ffaee219a8b1136d048995aa727fd303d1df9

      SHA256

      ef991083a11385baed0c1778378f7d4cb94e987b423ec3e198e883ad25c406dc

      SHA512

      69a1fa41336fb36f7bc5a53be88bdbdbd723ec7c38129af37708e36368684c43067a161c10db365f8b0bffa4afe06612e44004bdb8919af0eacba2df0336de94

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0680fae5e2e1fbabe8dacf1299122f9d

      SHA1

      2b902ac3e0edae0269786ff90c6b67bbdca4fd0d

      SHA256

      d473bcf5cad079af63947874b8ad80dfc0cc81ada72297cf0b7a9223cc522d1e

      SHA512

      3fb13970e1cd8cd59218dbc4ecd287bd7b09ebff54450922e230e365c4afbbfbbddcbc6a13a8cde044caf7160c911c71a74e6bc12246faf5f8474f02adfe5400

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

      Filesize

      482B

      MD5

      f6ae5dfda61194aec0ebae5dc0ac182f

      SHA1

      370c13e8ccf83dfe493266fc518557ecd2a1202d

      SHA256

      61ae843fe9c768f5e1a70b95a2d1dec82de68aca5d1de92ef0997db1cb7c2952

      SHA512

      6d93905a09ea6d4230b961258066fe3653edb326134245a749afa3211e51c59452167e161c96c5fc06c285b03f6cef4a338aa34d69a22e43b706943854a379b9

    • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe

      Filesize

      418KB

      MD5

      bc47d3a0d4a74adc40b3a7035344becb

      SHA1

      dd80bbe70106b62ea58924173a364cc936a0b1f4

      SHA256

      06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

      SHA512

      4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

    • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe

      Filesize

      418KB

      MD5

      bc47d3a0d4a74adc40b3a7035344becb

      SHA1

      dd80bbe70106b62ea58924173a364cc936a0b1f4

      SHA256

      06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

      SHA512

      4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

    • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe

      Filesize

      418KB

      MD5

      bc47d3a0d4a74adc40b3a7035344becb

      SHA1

      dd80bbe70106b62ea58924173a364cc936a0b1f4

      SHA256

      06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

      SHA512

      4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

    • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Local\c019dd54-c8d1-4cc8-b017-5d2198877b7d\file.exe

      Filesize

      803KB

      MD5

      126a3684f9aeb24f8accf168c8d3ff6f

      SHA1

      052b826371a6f8879102d304c294a927a6291867

      SHA256

      52d1dc1fb7fa7726e7527ef2412648ffbc5d78dc7ab551ca4e51078f213b709a

      SHA512

      11ab5e9123406b2735d59a0695e2477604d1f6d34389eb023f5a1f43ce777c4cbd2797d2f8265a859326b8cec889c72776c383f8f1a074fb97a0fbda0d977d80

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • \ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • \Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe

      Filesize

      418KB

      MD5

      bc47d3a0d4a74adc40b3a7035344becb

      SHA1

      dd80bbe70106b62ea58924173a364cc936a0b1f4

      SHA256

      06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

      SHA512

      4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

    • \Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build2.exe

      Filesize

      418KB

      MD5

      bc47d3a0d4a74adc40b3a7035344becb

      SHA1

      dd80bbe70106b62ea58924173a364cc936a0b1f4

      SHA256

      06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

      SHA512

      4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

    • \Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • \Users\Admin\AppData\Local\24341d9d-aff9-4cfd-b5e4-d2a531692543\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • memory/1156-101-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1156-123-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1156-102-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

    • memory/1156-100-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1156-91-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1212-59-0x0000000001D10000-0x0000000001E2B000-memory.dmp

      Filesize

      1.1MB

    • memory/1212-54-0x0000000001C50000-0x0000000001CE1000-memory.dmp

      Filesize

      580KB

    • memory/1212-58-0x0000000001C50000-0x0000000001CE1000-memory.dmp

      Filesize

      580KB

    • memory/1224-55-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1224-67-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1224-62-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1224-61-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1224-60-0x0000000076711000-0x0000000076713000-memory.dmp

      Filesize

      8KB

    • memory/1384-71-0x00000000002F0000-0x0000000000381000-memory.dmp

      Filesize

      580KB

    • memory/1384-66-0x00000000002F0000-0x0000000000381000-memory.dmp

      Filesize

      580KB

    • memory/1608-95-0x000000000026E000-0x0000000000297000-memory.dmp

      Filesize

      164KB

    • memory/1608-97-0x0000000000470000-0x00000000004B7000-memory.dmp

      Filesize

      284KB

    • memory/1832-80-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1832-126-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1832-73-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB