Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2023, 12:43

General

  • Target

    02786199.exe

  • Size

    730KB

  • MD5

    ea66d0ed1943bde2469351b61cec18e8

  • SHA1

    74f6883a9d8ca2476624561924408d7f1cb0f88d

  • SHA256

    ec1a02efe55e6f5733bbcc6370ddd1591445df56f854935e428c6e10c4a16423

  • SHA512

    7c149edf7a1c2ae970a7f1fd30d63151889ff58d1a30dac7a0c50d0cc33c329a7e872a8a951f532753c7248fc7dc4f2e3d12cefe075ae2b23bf65dc89f7dcbeb

  • SSDEEP

    12288:EMrky90lhUieqm+7xxp8Z1nkB8XyyRHn9O8+bv/kI1zlT8AbWG/0Pmobl:oyMleX+7xMZ1nkyXDJI8+bv/kczlTtCP

Malware Config

Extracted

Family

redline

Botnet

dars

C2

83.97.73.127:19045

Attributes
  • auth_value

    7cd208e6b6c927262304d5d4d88647fd

Extracted

Family

redline

Botnet

nitro

C2

83.97.73.127:19045

Attributes
  • auth_value

    1b68cf84b9b046f28b71cb39e44aa0e4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02786199.exe
    "C:\Users\Admin\AppData\Local\Temp\02786199.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9562625.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9562625.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9168857.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9168857.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7355909.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7355909.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1356
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4014525.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4014525.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4216
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7051747.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7051747.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:1960
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1480
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3660
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4828
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4276
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:540
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:544
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4368
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:1448
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2124895.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2124895.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4224
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3364
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:3740
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1972

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2124895.exe

                Filesize

                318KB

                MD5

                9e0f6bc5a73afa31d130567c72ca52fb

                SHA1

                3b7507b30c80936b2091268f3a38a3fc027d3ab7

                SHA256

                0874367a48edd23534f945787bedd20916d4b5f9f10a04e6d01da2ff57be10c4

                SHA512

                85513e7d9c284b0534629bfbff9c2bd278ec5323cd541299ba6701876ff142ef5831f15180880ba6154bfb194851db2758896484dbb9f9cb653a9823caa0288a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2124895.exe

                Filesize

                318KB

                MD5

                9e0f6bc5a73afa31d130567c72ca52fb

                SHA1

                3b7507b30c80936b2091268f3a38a3fc027d3ab7

                SHA256

                0874367a48edd23534f945787bedd20916d4b5f9f10a04e6d01da2ff57be10c4

                SHA512

                85513e7d9c284b0534629bfbff9c2bd278ec5323cd541299ba6701876ff142ef5831f15180880ba6154bfb194851db2758896484dbb9f9cb653a9823caa0288a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9562625.exe

                Filesize

                448KB

                MD5

                6a0a7efb6abfb5fd86180a2ac95a26b0

                SHA1

                b755e63a77ec897049e5f22a0a5c6738094d282d

                SHA256

                1c5107b7f318cfe47f16ef99032919c37e30cc1cbbf117031442f2c0e3ba09ad

                SHA512

                cd453ef9df2c4fc20d185704ae657c95ced08d90409de1f2fed711a6b7f6122fd82d073b7ac2fd2c77e0249d95fc88e252cd906760030925f7629b4b9d13cbdb

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9562625.exe

                Filesize

                448KB

                MD5

                6a0a7efb6abfb5fd86180a2ac95a26b0

                SHA1

                b755e63a77ec897049e5f22a0a5c6738094d282d

                SHA256

                1c5107b7f318cfe47f16ef99032919c37e30cc1cbbf117031442f2c0e3ba09ad

                SHA512

                cd453ef9df2c4fc20d185704ae657c95ced08d90409de1f2fed711a6b7f6122fd82d073b7ac2fd2c77e0249d95fc88e252cd906760030925f7629b4b9d13cbdb

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7051747.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7051747.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9168857.exe

                Filesize

                277KB

                MD5

                a9cc066622ab4a8050a4a0e55b0e3f52

                SHA1

                30c8c3a0849dcab8ac458fc7db03eacc00262e4a

                SHA256

                ec397a8e05d6a6a65e2790a7e69a48a197582e3a75fab299e3c35926a215b878

                SHA512

                876efddb235ae04a3b5641325e14baa9d778b41b3a2c5f1dff5d3817ddcc922c09f6d89be8f29643587a3a45dd714e136b58f6f890082862b0b57d93e5f439fb

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9168857.exe

                Filesize

                277KB

                MD5

                a9cc066622ab4a8050a4a0e55b0e3f52

                SHA1

                30c8c3a0849dcab8ac458fc7db03eacc00262e4a

                SHA256

                ec397a8e05d6a6a65e2790a7e69a48a197582e3a75fab299e3c35926a215b878

                SHA512

                876efddb235ae04a3b5641325e14baa9d778b41b3a2c5f1dff5d3817ddcc922c09f6d89be8f29643587a3a45dd714e136b58f6f890082862b0b57d93e5f439fb

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7355909.exe

                Filesize

                168KB

                MD5

                4b81e2a62e3734c55e2b53a052495d00

                SHA1

                130e4928e7e26bfab0e1072fc589ac393b4c0b4a

                SHA256

                0a0c8665d11990ac751a45f6025aa8f1ba57b7ebb6e2f57f2e46b912857d6c0f

                SHA512

                9664a6fd716aac7f86bc6df68a7866a5b200b1d35f84aa80ac1587c50d4b1b9c76194b00d96f18070b8d89a48b4abfd75c91bfb76f5c05bbd1533eebdb6ac87c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7355909.exe

                Filesize

                168KB

                MD5

                4b81e2a62e3734c55e2b53a052495d00

                SHA1

                130e4928e7e26bfab0e1072fc589ac393b4c0b4a

                SHA256

                0a0c8665d11990ac751a45f6025aa8f1ba57b7ebb6e2f57f2e46b912857d6c0f

                SHA512

                9664a6fd716aac7f86bc6df68a7866a5b200b1d35f84aa80ac1587c50d4b1b9c76194b00d96f18070b8d89a48b4abfd75c91bfb76f5c05bbd1533eebdb6ac87c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4014525.exe

                Filesize

                161KB

                MD5

                84717cc5ccdf16a480051dc1f21346ba

                SHA1

                6e4219b40e0caa76238214ec3567d4d1c091885c

                SHA256

                2363a2d3e0ffcfb0d7885a2e4adb272818600092f7d2fb44084baa2a8c849eef

                SHA512

                a16b02481efdcb734fd3c87b46b768fdfb89cabc875940d2a956e4fd9656056479d9c70d9e086bace5210c8e13f86242ffb4132de4c82b16a83f9b0b3bb84acd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4014525.exe

                Filesize

                161KB

                MD5

                84717cc5ccdf16a480051dc1f21346ba

                SHA1

                6e4219b40e0caa76238214ec3567d4d1c091885c

                SHA256

                2363a2d3e0ffcfb0d7885a2e4adb272818600092f7d2fb44084baa2a8c849eef

                SHA512

                a16b02481efdcb734fd3c87b46b768fdfb89cabc875940d2a956e4fd9656056479d9c70d9e086bace5210c8e13f86242ffb4132de4c82b16a83f9b0b3bb84acd

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                212KB

                MD5

                fad7aaf05d13bbeee7f5b9635d36d313

                SHA1

                f1d194d133ee20d2fcab6718c4f5d4155a1a51e7

                SHA256

                d75c96918f9269a8ef463d5d23b9f909f901fd18e71d8daa462a8b2b6a5f88d7

                SHA512

                75ca78e1b0c0c45d93ebbf958a5e1105eae900fa74d74c7ddb75e93a3bf0a534dd2e3a2ff2c98bc195457b52d1a9b59c4b0c4cc90709762cae395a12cf4f77e7

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1356-157-0x000000000A9D0000-0x000000000A9E2000-memory.dmp

                Filesize

                72KB

              • memory/1356-158-0x00000000054D0000-0x00000000054E0000-memory.dmp

                Filesize

                64KB

              • memory/1356-167-0x000000000BC80000-0x000000000BCD0000-memory.dmp

                Filesize

                320KB

              • memory/1356-166-0x000000000CA30000-0x000000000CF5C000-memory.dmp

                Filesize

                5.2MB

              • memory/1356-165-0x000000000BD30000-0x000000000BEF2000-memory.dmp

                Filesize

                1.8MB

              • memory/1356-164-0x00000000054D0000-0x00000000054E0000-memory.dmp

                Filesize

                64KB

              • memory/1356-163-0x000000000BF50000-0x000000000C4F4000-memory.dmp

                Filesize

                5.6MB

              • memory/1356-162-0x000000000ADC0000-0x000000000AE26000-memory.dmp

                Filesize

                408KB

              • memory/1356-154-0x0000000000B20000-0x0000000000B4E000-memory.dmp

                Filesize

                184KB

              • memory/1356-155-0x000000000AF80000-0x000000000B598000-memory.dmp

                Filesize

                6.1MB

              • memory/1356-161-0x000000000AE60000-0x000000000AEF2000-memory.dmp

                Filesize

                584KB

              • memory/1356-160-0x000000000AD40000-0x000000000ADB6000-memory.dmp

                Filesize

                472KB

              • memory/1356-159-0x000000000AA30000-0x000000000AA6C000-memory.dmp

                Filesize

                240KB

              • memory/1356-156-0x000000000AAA0000-0x000000000ABAA000-memory.dmp

                Filesize

                1.0MB

              • memory/3364-200-0x0000000004E50000-0x0000000004E60000-memory.dmp

                Filesize

                64KB

              • memory/3364-195-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/4216-173-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB