Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/05/2023, 07:16

General

  • Target

    7b5dd75c4d2f5dbba3b3796a08aa1eb6e6bf1e1fb34db4814c8bede5767a4558.exe

  • Size

    771KB

  • MD5

    b4bd3fa7a69d9164515bb77af0ca55b7

  • SHA1

    eacc0677828ecc8a0a04def1b2ca5d87ff67ea30

  • SHA256

    7b5dd75c4d2f5dbba3b3796a08aa1eb6e6bf1e1fb34db4814c8bede5767a4558

  • SHA512

    3f46df41a8f8a0624e7183d537cf654edd675cf07d803a14881716b9fd8109ca2be91b381b4e06e6c369d4867b94a70f6add36799a86476e7535e25e0fedcffb

  • SSDEEP

    24576:UyP2iPOzP7YNxqawigLfvO7OvWUGQ1ax:j5WzENxkJbvfvrG4

Malware Config

Extracted

Family

redline

Botnet

mura

C2

83.97.73.127:19062

Attributes
  • auth_value

    b2ee4a66a20fb9e998d6a68277565331

Extracted

Family

redline

Botnet

heroy

C2

83.97.73.127:19062

Attributes
  • auth_value

    b2879468e50d2d36e66f1a067d4a8bb3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b5dd75c4d2f5dbba3b3796a08aa1eb6e6bf1e1fb34db4814c8bede5767a4558.exe
    "C:\Users\Admin\AppData\Local\Temp\7b5dd75c4d2f5dbba3b3796a08aa1eb6e6bf1e1fb34db4814c8bede5767a4558.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2428561.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2428561.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7295214.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7295214.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7665522.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7665522.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3920
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4512862.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4512862.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3004
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4868257.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4868257.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4860
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4108
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3408
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:3448
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4428
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:N"
                    6⤵
                      PID:3412
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:3900
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4448
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:2180
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2285540.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2285540.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4888
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3232
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1812
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4548

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                957779c42144282d8cd83192b8fbc7cf

                SHA1

                de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

                SHA256

                0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

                SHA512

                f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2285540.exe

                Filesize

                327KB

                MD5

                95b0a825adef328ff02c7338b4f6ceec

                SHA1

                a77ea8c3ed173494924c3bc313abf9eafad4331c

                SHA256

                b2becf84c2c7c85c22406669244ba167d39d00a43ac21a56397405be2ca34139

                SHA512

                89f0d92bfe91ecc4837cb89274c4fbf8d5809472577097c9566ac10e23b1c870ce719c7074b2b6c66411fe284a3a2cbd74e923e3e9da29d5a692e5579dffb957

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2285540.exe

                Filesize

                327KB

                MD5

                95b0a825adef328ff02c7338b4f6ceec

                SHA1

                a77ea8c3ed173494924c3bc313abf9eafad4331c

                SHA256

                b2becf84c2c7c85c22406669244ba167d39d00a43ac21a56397405be2ca34139

                SHA512

                89f0d92bfe91ecc4837cb89274c4fbf8d5809472577097c9566ac10e23b1c870ce719c7074b2b6c66411fe284a3a2cbd74e923e3e9da29d5a692e5579dffb957

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2428561.exe

                Filesize

                451KB

                MD5

                896c99cc78fb8ad01e78c3cb01cd1715

                SHA1

                af4075987f4a6035b2b301fa60916a16d0dc1b81

                SHA256

                0d9f2de0fb482b08663c28b0e87bc5f2a9c8cf0d8a24d63ab7e423b40b03aa8d

                SHA512

                2595ce2d8375ef4a8c2a6c0dcadf274d1346896517fa0bdfd814e4fd809b636ce1305a7dd770426b2b7a7404a4fcf8f1f615a3200340a4f06005ca31b7137928

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2428561.exe

                Filesize

                451KB

                MD5

                896c99cc78fb8ad01e78c3cb01cd1715

                SHA1

                af4075987f4a6035b2b301fa60916a16d0dc1b81

                SHA256

                0d9f2de0fb482b08663c28b0e87bc5f2a9c8cf0d8a24d63ab7e423b40b03aa8d

                SHA512

                2595ce2d8375ef4a8c2a6c0dcadf274d1346896517fa0bdfd814e4fd809b636ce1305a7dd770426b2b7a7404a4fcf8f1f615a3200340a4f06005ca31b7137928

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4868257.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4868257.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7295214.exe

                Filesize

                279KB

                MD5

                1cddd132c7775a01b4b0b2d8e42c6068

                SHA1

                f6ae77eb63768f11bf5cc05b3514a98cc9e5ca33

                SHA256

                c5b265898fd0726ee1c907f786e300cb4d42376cb651450305446888e4a23c72

                SHA512

                6b74bd7afef79d9d82a89c7305c1ba833219627f0d8d7e3b233d7e8a1cbbbea6beebaf0a9e7fb187b9782892240984a6e09924f276277617dec93a1d36e7e56e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7295214.exe

                Filesize

                279KB

                MD5

                1cddd132c7775a01b4b0b2d8e42c6068

                SHA1

                f6ae77eb63768f11bf5cc05b3514a98cc9e5ca33

                SHA256

                c5b265898fd0726ee1c907f786e300cb4d42376cb651450305446888e4a23c72

                SHA512

                6b74bd7afef79d9d82a89c7305c1ba833219627f0d8d7e3b233d7e8a1cbbbea6beebaf0a9e7fb187b9782892240984a6e09924f276277617dec93a1d36e7e56e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7665522.exe

                Filesize

                193KB

                MD5

                f8a61df65ff1b2d63eec3a65e6c0c2bb

                SHA1

                ac8b8374edb93c91cb011b6a4088facaeb70f66a

                SHA256

                5cd18a472517d1fcd49ef2221a26f30d89ac67cabe79b2f9469f9d7edf7d5334

                SHA512

                75e70d3800ee42ff531f2d23a65f189d29f7a9cc06b9cc1f4ccc70d975433bc21f8ca8ee83e55118acf1efab267a6dabe67949b5a171f1f08d6cebce20801b6d

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7665522.exe

                Filesize

                193KB

                MD5

                f8a61df65ff1b2d63eec3a65e6c0c2bb

                SHA1

                ac8b8374edb93c91cb011b6a4088facaeb70f66a

                SHA256

                5cd18a472517d1fcd49ef2221a26f30d89ac67cabe79b2f9469f9d7edf7d5334

                SHA512

                75e70d3800ee42ff531f2d23a65f189d29f7a9cc06b9cc1f4ccc70d975433bc21f8ca8ee83e55118acf1efab267a6dabe67949b5a171f1f08d6cebce20801b6d

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4512862.exe

                Filesize

                145KB

                MD5

                5f610858fea379336873f518a62ef33c

                SHA1

                f3419188e253445910c6148df15c07b31f6114c9

                SHA256

                91663cce09c3fef8e38bfb60592729e6d16ed05f5eac2908eef6e395081f51ea

                SHA512

                a053bcd5628595da17fdbbfa100d480b3948ea8f31d3d1efdfa460f8d1ee9f7e65a0afc68dad53e629e7c9fa9b56c4c42e5194f1d35d0f8102e2de4dfa0b6a1e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4512862.exe

                Filesize

                145KB

                MD5

                5f610858fea379336873f518a62ef33c

                SHA1

                f3419188e253445910c6148df15c07b31f6114c9

                SHA256

                91663cce09c3fef8e38bfb60592729e6d16ed05f5eac2908eef6e395081f51ea

                SHA512

                a053bcd5628595da17fdbbfa100d480b3948ea8f31d3d1efdfa460f8d1ee9f7e65a0afc68dad53e629e7c9fa9b56c4c42e5194f1d35d0f8102e2de4dfa0b6a1e

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                1c4798b76f6e7d62f21ba8e8334ddf44

                SHA1

                64e09b11b611aea1d69c81619fa09551121d11a9

                SHA256

                2cd852064b0d2e03fb28501eca48d1bdaf31e1225b988e245b6d3480e3135e79

                SHA512

                7ff5e4f2540a75f5fbd1ed330c1c453c32f6d3a70330a162f06a6bb3f5b809c77e11db740299db3d999c19dc5864f28f62f3d2d09ba3b83700535c5bd6589a31

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • memory/3004-155-0x0000000005210000-0x0000000005816000-memory.dmp

                Filesize

                6.0MB

              • memory/3004-159-0x0000000004D10000-0x0000000004D4E000-memory.dmp

                Filesize

                248KB

              • memory/3004-189-0x0000000006640000-0x00000000066B6000-memory.dmp

                Filesize

                472KB

              • memory/3004-188-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                Filesize

                64KB

              • memory/3004-187-0x0000000006AF0000-0x000000000701C000-memory.dmp

                Filesize

                5.2MB

              • memory/3004-186-0x00000000063F0000-0x00000000065B2000-memory.dmp

                Filesize

                1.8MB

              • memory/3004-171-0x0000000005130000-0x0000000005196000-memory.dmp

                Filesize

                408KB

              • memory/3004-170-0x0000000005D20000-0x000000000621E000-memory.dmp

                Filesize

                5.0MB

              • memory/3004-169-0x0000000005090000-0x0000000005122000-memory.dmp

                Filesize

                584KB

              • memory/3004-154-0x0000000000460000-0x000000000048A000-memory.dmp

                Filesize

                168KB

              • memory/3004-164-0x0000000004E90000-0x0000000004EDB000-memory.dmp

                Filesize

                300KB

              • memory/3004-156-0x0000000004D80000-0x0000000004E8A000-memory.dmp

                Filesize

                1.0MB

              • memory/3004-157-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

                Filesize

                72KB

              • memory/3004-190-0x00000000065C0000-0x0000000006610000-memory.dmp

                Filesize

                320KB

              • memory/3004-158-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                Filesize

                64KB

              • memory/3232-216-0x0000000009760000-0x00000000097AB000-memory.dmp

                Filesize

                300KB

              • memory/3232-215-0x0000000009640000-0x0000000009650000-memory.dmp

                Filesize

                64KB

              • memory/3232-206-0x0000000000400000-0x000000000042A000-memory.dmp

                Filesize

                168KB

              • memory/3920-143-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB