Analysis

  • max time kernel
    99s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/05/2023, 12:15

General

  • Target

    d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727.exe

  • Size

    787KB

  • MD5

    1ab08e9c8bfd80d75bc34961d809656d

  • SHA1

    de7da0e63dad026ad7f085bbeb64a188a950dfb9

  • SHA256

    d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727

  • SHA512

    d711df2e9b745b404d0f58b70c0b2cf92e980fdf16079765caca0c0770411a373179bae5704f39b916dade8994365153192afccadcd92b509057f4f052ef4efb

  • SSDEEP

    12288:BMrYy90ZedXmScjTOMxDVQ0/T9RDTBsVi64IzdmazjoAM3f2bPX2uixRubd:VyBdXmSYTOsDfRO4IzdJzjoABvQubd

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.127:19045

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727.exe
    "C:\Users\Admin\AppData\Local\Temp\d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1763375.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1763375.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9437544.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9437544.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9038948.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9038948.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4164
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4192
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2513222.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2513222.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8727169.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8727169.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3880
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3692
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2632
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4464
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4724
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4308
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4336
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4364
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4636
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3452
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8391474.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8391474.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4404
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4444
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4956
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:2128

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                957779c42144282d8cd83192b8fbc7cf

                SHA1

                de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

                SHA256

                0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

                SHA512

                f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8391474.exe

                Filesize

                321KB

                MD5

                043a0643b406565394febd8dd3b26749

                SHA1

                f654a8efcea5bd6602e23b45609feb1163da8b58

                SHA256

                42802ccccf6f884ee6f0f1c167457e59101bd42f512f0d57f82e8a120599be9a

                SHA512

                8ca30de60769a529b49ae1c8254b354dad8b77c401c3c2e280dc82536604c60e2ee08131846222cfe434a3315ffe9a08dc0f5547fbb8975638470adcadea2b5e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8391474.exe

                Filesize

                321KB

                MD5

                043a0643b406565394febd8dd3b26749

                SHA1

                f654a8efcea5bd6602e23b45609feb1163da8b58

                SHA256

                42802ccccf6f884ee6f0f1c167457e59101bd42f512f0d57f82e8a120599be9a

                SHA512

                8ca30de60769a529b49ae1c8254b354dad8b77c401c3c2e280dc82536604c60e2ee08131846222cfe434a3315ffe9a08dc0f5547fbb8975638470adcadea2b5e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1763375.exe

                Filesize

                452KB

                MD5

                51b9d6f0a7d982e7b5c5f19305308da3

                SHA1

                ac06ecc5700c5be8290a3edc5420d92a97881d9c

                SHA256

                37f2ee0bc2a1b9be9b6b04e8ab38567153876250eb8824a9f65b2e68135924ed

                SHA512

                044e6750448867b086a2031e3172c6faef38f6d45c485d178483b02dee8413c96425920189ebe3026777b4b2e9b9349a3cbdc937a8f71568c7f4daaec83550fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1763375.exe

                Filesize

                452KB

                MD5

                51b9d6f0a7d982e7b5c5f19305308da3

                SHA1

                ac06ecc5700c5be8290a3edc5420d92a97881d9c

                SHA256

                37f2ee0bc2a1b9be9b6b04e8ab38567153876250eb8824a9f65b2e68135924ed

                SHA512

                044e6750448867b086a2031e3172c6faef38f6d45c485d178483b02dee8413c96425920189ebe3026777b4b2e9b9349a3cbdc937a8f71568c7f4daaec83550fd

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8727169.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8727169.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9437544.exe

                Filesize

                280KB

                MD5

                74bfb0064892d17794dbdef98954f980

                SHA1

                55a68c2e33f150e889d31c20aa088524b49c200d

                SHA256

                de6308809b1ea3ee574eed21987cfefdb34c1687871e437e36fc6a0cc9a62a08

                SHA512

                7783fade63d004da95b52ecfbc49c07d3b011fc6889e75520933efccfb431010eb353f62dcf0417e015743b1f504351e6a0f9b58976622ec4f86d46a356ad32e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9437544.exe

                Filesize

                280KB

                MD5

                74bfb0064892d17794dbdef98954f980

                SHA1

                55a68c2e33f150e889d31c20aa088524b49c200d

                SHA256

                de6308809b1ea3ee574eed21987cfefdb34c1687871e437e36fc6a0cc9a62a08

                SHA512

                7783fade63d004da95b52ecfbc49c07d3b011fc6889e75520933efccfb431010eb353f62dcf0417e015743b1f504351e6a0f9b58976622ec4f86d46a356ad32e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9038948.exe

                Filesize

                164KB

                MD5

                7de99bfe1719c5af607d0d83cc8d6b21

                SHA1

                a9ed8ec8fa496f61cdab51bcfa37cf6660ed87fd

                SHA256

                31c1cdcf3204451f32c2eb874dcbbb7c960c5e0336846080572b1a6e32be7dfe

                SHA512

                f49aeb63d4d8268857217d7d133fbdc51fb5822b181d61723704eac37989f0a00f2414efe851ce14a9a407489757f63e51bece73b8cf593dd74af6dbb2345bb1

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9038948.exe

                Filesize

                164KB

                MD5

                7de99bfe1719c5af607d0d83cc8d6b21

                SHA1

                a9ed8ec8fa496f61cdab51bcfa37cf6660ed87fd

                SHA256

                31c1cdcf3204451f32c2eb874dcbbb7c960c5e0336846080572b1a6e32be7dfe

                SHA512

                f49aeb63d4d8268857217d7d133fbdc51fb5822b181d61723704eac37989f0a00f2414efe851ce14a9a407489757f63e51bece73b8cf593dd74af6dbb2345bb1

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2513222.exe

                Filesize

                167KB

                MD5

                c717626072ca2e172efa8b00990a2aea

                SHA1

                5241ac8b22c008c73e4feb79bd1e83691cc827e3

                SHA256

                e6819565c9ae8d0a5a2766dd1a072edea575766026bad27356bb3edf866d85ae

                SHA512

                1f08525077a0e5acbeb20e7a40241090ebef011c3749972cf249de7dab0e77df50e3b00b5e6339ed9f7829f824f772e0fa83793a75ddaad49f8b63aba374f693

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2513222.exe

                Filesize

                167KB

                MD5

                c717626072ca2e172efa8b00990a2aea

                SHA1

                5241ac8b22c008c73e4feb79bd1e83691cc827e3

                SHA256

                e6819565c9ae8d0a5a2766dd1a072edea575766026bad27356bb3edf866d85ae

                SHA512

                1f08525077a0e5acbeb20e7a40241090ebef011c3749972cf249de7dab0e77df50e3b00b5e6339ed9f7829f824f772e0fa83793a75ddaad49f8b63aba374f693

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                cb1eb1196b1593f61b7fd74149b019b6

                SHA1

                8f706c446da58cab290be5d187fcfc3cf93e0487

                SHA256

                8e1b9307bc3a9f52b91334e4f0322468c79efaf1c4d36f5033e58f4f9dfe9cf2

                SHA512

                09b8169a9220a02d5a7fb23cf4c15a1c64a661d57c5ede5d12f0e5805bab2f9218e57407d36ea482cb986fe59ab070099d72bcb51f18a2665213cc1dd398abae

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • memory/4192-139-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB

              • memory/4220-151-0x0000000002FD0000-0x0000000002FD6000-memory.dmp

                Filesize

                24KB

              • memory/4220-167-0x000000000AF40000-0x000000000AFD2000-memory.dmp

                Filesize

                584KB

              • memory/4220-186-0x000000000CA60000-0x000000000CF8C000-memory.dmp

                Filesize

                5.2MB

              • memory/4220-185-0x000000000C360000-0x000000000C522000-memory.dmp

                Filesize

                1.8MB

              • memory/4220-170-0x000000000BB40000-0x000000000BB90000-memory.dmp

                Filesize

                320KB

              • memory/4220-169-0x000000000AFE0000-0x000000000B046000-memory.dmp

                Filesize

                408KB

              • memory/4220-168-0x000000000BB90000-0x000000000C08E000-memory.dmp

                Filesize

                5.0MB

              • memory/4220-154-0x000000000AAA0000-0x000000000AAB2000-memory.dmp

                Filesize

                72KB

              • memory/4220-166-0x000000000AE20000-0x000000000AE96000-memory.dmp

                Filesize

                472KB

              • memory/4220-187-0x00000000056E0000-0x00000000056F0000-memory.dmp

                Filesize

                64KB

              • memory/4220-157-0x00000000056E0000-0x00000000056F0000-memory.dmp

                Filesize

                64KB

              • memory/4220-150-0x0000000000D70000-0x0000000000D9E000-memory.dmp

                Filesize

                184KB

              • memory/4220-152-0x000000000B080000-0x000000000B686000-memory.dmp

                Filesize

                6.0MB

              • memory/4220-153-0x000000000AB80000-0x000000000AC8A000-memory.dmp

                Filesize

                1.0MB

              • memory/4220-156-0x000000000AC90000-0x000000000ACDB000-memory.dmp

                Filesize

                300KB

              • memory/4220-155-0x000000000AB00000-0x000000000AB3E000-memory.dmp

                Filesize

                248KB

              • memory/4444-203-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/4444-214-0x0000000008D10000-0x0000000008D20000-memory.dmp

                Filesize

                64KB

              • memory/4444-213-0x0000000008E20000-0x0000000008E6B000-memory.dmp

                Filesize

                300KB

              • memory/4444-212-0x0000000006450000-0x0000000006456000-memory.dmp

                Filesize

                24KB