Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:40

General

  • Target

    47715e3af503e0af015e83dfc578f5bb9897d6b858bc0cb167c30c9243fcfb44.exe

  • Size

    1.1MB

  • MD5

    be693d26186f6b62604cd29c7eaf1c34

  • SHA1

    7eacf287c6476758758a1d4a60a3bee85dacd9bf

  • SHA256

    47715e3af503e0af015e83dfc578f5bb9897d6b858bc0cb167c30c9243fcfb44

  • SHA512

    912b7e26ab6d0ff375eb8352b32bf26727d1416d8b03d0ddb84a9b59b95db10365b1d9bbd77c58e8f8f638d0b371fa7ebf5ce2996cf1b2e7184e6147178460ca

  • SSDEEP

    24576:Eyy5V7kZKCaJnl4lgm0bqXavJh2bJj6FmL8bw4RnZs:Ty5V76KzX4IbOqJ+6mQ8

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47715e3af503e0af015e83dfc578f5bb9897d6b858bc0cb167c30c9243fcfb44.exe
    "C:\Users\Admin\AppData\Local\Temp\47715e3af503e0af015e83dfc578f5bb9897d6b858bc0cb167c30c9243fcfb44.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DP638255.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DP638255.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu945756.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu945756.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YJ892000.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YJ892000.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\113465123.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\113465123.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3832
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\298536999.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\298536999.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4648
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1084
              6⤵
              • Program crash
              PID:1472
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326888889.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326888889.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4764
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4640
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4524
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:4348
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  7⤵
                    PID:4308
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:R" /E
                    7⤵
                      PID:1364
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\cb7ae701b3" /P "Admin:N"
                      7⤵
                        PID:1132
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        7⤵
                          PID:1140
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:R" /E
                          7⤵
                            PID:4468
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\421283464.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\421283464.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4480
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4648 -ip 4648
                1⤵
                  PID:1896
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2768

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DP638255.exe

                  Filesize

                  929KB

                  MD5

                  7f310233b2d8276f2960283c68a4841d

                  SHA1

                  7bcce511fcc28e4b934c0735051b4329f94e3ef9

                  SHA256

                  a772787023653e9eef919002d98509ff11e8fc334cacef7becaef6f5c1c1dbbf

                  SHA512

                  5fcaaca0b1a4c4490d83f5cca95201382552b543df3050607c31d33f9671cef267d2df7b659e3120249bc3281c5afc7081cb0f5d2e060d6512720c09004c55f0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DP638255.exe

                  Filesize

                  929KB

                  MD5

                  7f310233b2d8276f2960283c68a4841d

                  SHA1

                  7bcce511fcc28e4b934c0735051b4329f94e3ef9

                  SHA256

                  a772787023653e9eef919002d98509ff11e8fc334cacef7becaef6f5c1c1dbbf

                  SHA512

                  5fcaaca0b1a4c4490d83f5cca95201382552b543df3050607c31d33f9671cef267d2df7b659e3120249bc3281c5afc7081cb0f5d2e060d6512720c09004c55f0

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\421283464.exe

                  Filesize

                  340KB

                  MD5

                  42e460351bbcd31834dce5c95f0172ff

                  SHA1

                  39d41c14bfa6e68c8ad42ae6aadb0e7a877869f9

                  SHA256

                  e76e36e01f6b6d87505c07af87a9d206262a026105727d610114578d67431ade

                  SHA512

                  a77677935e6175627079c4c7dba7771e2f301658f48a12429042e7ac7b6fdd92fd489aea9f861414769dc2e285b282a35d20809dbe013a51c4af03078cf2c4d3

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\421283464.exe

                  Filesize

                  340KB

                  MD5

                  42e460351bbcd31834dce5c95f0172ff

                  SHA1

                  39d41c14bfa6e68c8ad42ae6aadb0e7a877869f9

                  SHA256

                  e76e36e01f6b6d87505c07af87a9d206262a026105727d610114578d67431ade

                  SHA512

                  a77677935e6175627079c4c7dba7771e2f301658f48a12429042e7ac7b6fdd92fd489aea9f861414769dc2e285b282a35d20809dbe013a51c4af03078cf2c4d3

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu945756.exe

                  Filesize

                  577KB

                  MD5

                  a2a32595dcf62c0e62054af1f91930cf

                  SHA1

                  6f2cbe8d68c414746e68e5e07c5f5e2c07b9b8a0

                  SHA256

                  b96751ac29088d99548cce0434a26c4cca5b0587ff57fbc34a59cd99f2167873

                  SHA512

                  450e4607c8ae22938ff98f627ad38c508b29ed20687225ca4b473da006e879304810c75660ae2d752c9fb82ef52f4b45c723ebf892be5806ca8f320d82656850

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu945756.exe

                  Filesize

                  577KB

                  MD5

                  a2a32595dcf62c0e62054af1f91930cf

                  SHA1

                  6f2cbe8d68c414746e68e5e07c5f5e2c07b9b8a0

                  SHA256

                  b96751ac29088d99548cce0434a26c4cca5b0587ff57fbc34a59cd99f2167873

                  SHA512

                  450e4607c8ae22938ff98f627ad38c508b29ed20687225ca4b473da006e879304810c75660ae2d752c9fb82ef52f4b45c723ebf892be5806ca8f320d82656850

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326888889.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326888889.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YJ892000.exe

                  Filesize

                  405KB

                  MD5

                  7d95a725187a4910aa7f9b4b0f15b97a

                  SHA1

                  532e16e0d5f5335ee94bfd1a3cefa09c1ad54b18

                  SHA256

                  d137fc5facb16cc6fd2851a78283b5872a45d713f49c63cfb7e5407d9a218173

                  SHA512

                  c2fac2c15993f41f851fa2031832899dc1272d999d6eae366dcfaff91dc3fa0288af38a1a3e488f85b6561e511fbfe63eb0e7bb4f7e7add7b85847a9831062d8

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YJ892000.exe

                  Filesize

                  405KB

                  MD5

                  7d95a725187a4910aa7f9b4b0f15b97a

                  SHA1

                  532e16e0d5f5335ee94bfd1a3cefa09c1ad54b18

                  SHA256

                  d137fc5facb16cc6fd2851a78283b5872a45d713f49c63cfb7e5407d9a218173

                  SHA512

                  c2fac2c15993f41f851fa2031832899dc1272d999d6eae366dcfaff91dc3fa0288af38a1a3e488f85b6561e511fbfe63eb0e7bb4f7e7add7b85847a9831062d8

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\113465123.exe

                  Filesize

                  176KB

                  MD5

                  2b71f4b18ac8214a2bff547b6ce2f64f

                  SHA1

                  b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

                  SHA256

                  f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

                  SHA512

                  33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\113465123.exe

                  Filesize

                  176KB

                  MD5

                  2b71f4b18ac8214a2bff547b6ce2f64f

                  SHA1

                  b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

                  SHA256

                  f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

                  SHA512

                  33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\298536999.exe

                  Filesize

                  258KB

                  MD5

                  ebabe82f5af124bc107421a37fa2070b

                  SHA1

                  323be9e2f07780fa3abf9801013f8c45f2df2a62

                  SHA256

                  d40b64f324878999d92654916383da69ce5cf108742011485c35da9b41059a54

                  SHA512

                  35c1c8f108dda748ce940ec5203bd53ca99a5e477edf136cd8149c2dd8600dca2dde57b3c4091bf7f5ff4304aed92f0d7d9aa095a1b6c9dc46353a9050a04616

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\298536999.exe

                  Filesize

                  258KB

                  MD5

                  ebabe82f5af124bc107421a37fa2070b

                  SHA1

                  323be9e2f07780fa3abf9801013f8c45f2df2a62

                  SHA256

                  d40b64f324878999d92654916383da69ce5cf108742011485c35da9b41059a54

                  SHA512

                  35c1c8f108dda748ce940ec5203bd53ca99a5e477edf136cd8149c2dd8600dca2dde57b3c4091bf7f5ff4304aed92f0d7d9aa095a1b6c9dc46353a9050a04616

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • memory/3832-171-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-173-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-181-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-183-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-185-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-189-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-191-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-187-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-192-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3832-193-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3832-177-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-175-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-161-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3832-162-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3832-163-0x0000000004AB0000-0x0000000005054000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3832-164-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-165-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-167-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-169-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/3832-179-0x0000000004950000-0x0000000004963000-memory.dmp

                  Filesize

                  76KB

                • memory/4480-1051-0x000000000A300000-0x000000000A312000-memory.dmp

                  Filesize

                  72KB

                • memory/4480-1052-0x000000000A320000-0x000000000A42A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4480-1058-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-1057-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-1056-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-1054-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-1053-0x000000000A440000-0x000000000A47C000-memory.dmp

                  Filesize

                  240KB

                • memory/4480-411-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-409-0x0000000002DC0000-0x0000000002E06000-memory.dmp

                  Filesize

                  280KB

                • memory/4480-256-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4480-258-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4480-255-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4480-1050-0x0000000009C50000-0x000000000A268000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4480-413-0x0000000007210000-0x0000000007220000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-228-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-236-0x0000000000400000-0x0000000002B9B000-memory.dmp

                  Filesize

                  39.6MB

                • memory/4648-235-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-229-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-230-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-231-0x0000000000400000-0x0000000002B9B000-memory.dmp

                  Filesize

                  39.6MB

                • memory/4648-234-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-233-0x0000000004B90000-0x0000000004BA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4648-227-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

                  Filesize

                  180KB