b40efaeb4eacd8259e6e0c447e0f18a7882a7c46e8039e986b074704ca175fa3

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2f730c0c652382fb02c9619865971510.exe
Size

741KB
MD5

2f730c0c652382fb02c9619865971510
SHA1

8ec21234062163c9765d6aab75b8243597a1aa02
SHA256

b40efaeb4eacd8259e6e0c447e0f18a7882a7c46e8039e986b074704ca175fa3
SHA512

33f915a77b264d785c5edde324c6bf0442653e892984fbe742042a0a82db20802402e3c7817c2e39b55dd24aa220539fc5d249e5ceaca622b135d36ba597c01b
SSDEEP

12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fp:lIt4kt0Kd6F6CNzYhUiEWEYcwh

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2572	explorer.exe
2716	spoolsv.exe
2752	svchost.exe
2596	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2572	explorer.exe
2716	spoolsv.exe
2752	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2572	explorer.exe
2716	spoolsv.exe
2752	svchost.exe
2596	spoolsv.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2572	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	NEAS.2f730c0c652382fb02c9619865971510.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
268	schtasks.exe
2600	schtasks.exe
1084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2716	spoolsv.exe
2716	spoolsv.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2572	explorer.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2572	explorer.exe
2572	explorer.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2572	explorer.exe
2752	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2560	NEAS.2f730c0c652382fb02c9619865971510.exe
2572	explorer.exe
2572	explorer.exe
2572	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2716	spoolsv.exe
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe
2596	spoolsv.exe
2596	spoolsv.exe
2596	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2572	2560	NEAS.2f730c0c652382fb02c9619865971510.exe	28
PID 2560 wrote to memory of 2572	2560	NEAS.2f730c0c652382fb02c9619865971510.exe	28
PID 2560 wrote to memory of 2572	2560	NEAS.2f730c0c652382fb02c9619865971510.exe	28
PID 2560 wrote to memory of 2572	2560	NEAS.2f730c0c652382fb02c9619865971510.exe	28
PID 2572 wrote to memory of 2716	2572	explorer.exe	29
PID 2572 wrote to memory of 2716	2572	explorer.exe	29
PID 2572 wrote to memory of 2716	2572	explorer.exe	29
PID 2572 wrote to memory of 2716	2572	explorer.exe	29
PID 2716 wrote to memory of 2752	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2752	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2752	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2752	2716	spoolsv.exe	30
PID 2752 wrote to memory of 2596	2752	svchost.exe	31
PID 2752 wrote to memory of 2596	2752	svchost.exe	31
PID 2752 wrote to memory of 2596	2752	svchost.exe	31
PID 2752 wrote to memory of 2596	2752	svchost.exe	31
PID 2572 wrote to memory of 2496	2572	explorer.exe	32
PID 2572 wrote to memory of 2496	2572	explorer.exe	32
PID 2572 wrote to memory of 2496	2572	explorer.exe	32
PID 2572 wrote to memory of 2496	2572	explorer.exe	32
PID 2752 wrote to memory of 2600	2752	svchost.exe	33
PID 2752 wrote to memory of 2600	2752	svchost.exe	33
PID 2752 wrote to memory of 2600	2752	svchost.exe	33
PID 2752 wrote to memory of 2600	2752	svchost.exe	33
PID 2752 wrote to memory of 1084	2752	svchost.exe	38
PID 2752 wrote to memory of 1084	2752	svchost.exe	38
PID 2752 wrote to memory of 1084	2752	svchost.exe	38
PID 2752 wrote to memory of 1084	2752	svchost.exe	38
PID 2752 wrote to memory of 268	2752	svchost.exe	40
PID 2752 wrote to memory of 268	2752	svchost.exe	40
PID 2752 wrote to memory of 268	2752	svchost.exe	40
PID 2752 wrote to memory of 268	2752	svchost.exe	40

C:\Users\Admin\AppData\Local\Temp\NEAS.2f730c0c652382fb02c9619865971510.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2f730c0c652382fb02c9619865971510.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:55 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2600
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:56 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:57 /f
        5⤵
        Creates scheduled task(s)
        
        PID:268
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
742KB

MD5
0ddb02d76be36069da6ff95b772f2167

SHA1
5497e83209ff9a5aeef5a4879c3b05aebcb0a2ff

SHA256
430c46b39006a511c7bc65a4f33de8e892899f056e122609eda59eba7a9b0683

SHA512
709aed8f035086db1481ff559123af93896893d1c3b493c779ca43d333f2b247899f29544a97e9931d3321cdf68b6320a3f02b05e0fa08b98935bdc1cd786651

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
741KB

MD5
3808479656b95e2897ef5759daf5de63

SHA1
55f71e00d9a1908c1bfd7f40faae1283ef570076

SHA256
65991a8016b2ee0473c80dc9a4c9705035bb144a770eae5238b6582e3648b9fb

SHA512
8186ee8d711cf8fc064defb9a346adbcc90073e598191cd8badb9c71ba53f45394aa6ebb73e0e3c5d392a9379037b200de6a84fc1f8d4a7650e2b3586976db2f

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
741KB

MD5
3808479656b95e2897ef5759daf5de63

SHA1
55f71e00d9a1908c1bfd7f40faae1283ef570076

SHA256
65991a8016b2ee0473c80dc9a4c9705035bb144a770eae5238b6582e3648b9fb

SHA512
8186ee8d711cf8fc064defb9a346adbcc90073e598191cd8badb9c71ba53f45394aa6ebb73e0e3c5d392a9379037b200de6a84fc1f8d4a7650e2b3586976db2f

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
742KB

MD5
0ddb02d76be36069da6ff95b772f2167

SHA1
5497e83209ff9a5aeef5a4879c3b05aebcb0a2ff

SHA256
430c46b39006a511c7bc65a4f33de8e892899f056e122609eda59eba7a9b0683

SHA512
709aed8f035086db1481ff559123af93896893d1c3b493c779ca43d333f2b247899f29544a97e9931d3321cdf68b6320a3f02b05e0fa08b98935bdc1cd786651

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
742KB

MD5
0ddb02d76be36069da6ff95b772f2167

SHA1
5497e83209ff9a5aeef5a4879c3b05aebcb0a2ff

SHA256
430c46b39006a511c7bc65a4f33de8e892899f056e122609eda59eba7a9b0683

SHA512
709aed8f035086db1481ff559123af93896893d1c3b493c779ca43d333f2b247899f29544a97e9931d3321cdf68b6320a3f02b05e0fa08b98935bdc1cd786651

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
25eeb18b71d63ba040717a1a2c5e9826

SHA1
7435187bc5efd9eca48631691369f6dad7a2ec14

SHA256
335a20628cd3c55506c500f090b04bfc91c9f0fb4046c56f5d57798f9e3c5ac9

SHA512
ac45a3d07408806ca9b9f0a0e24496428c226d6af75c316510a600b6ce306d6f53983ce940517f433c2193861e50215b099d483425b40fab3ddfd25c23778e3d

Download Submit
\Windows\Resources\svchost.exe

Filesize
741KB

MD5
3808479656b95e2897ef5759daf5de63

SHA1
55f71e00d9a1908c1bfd7f40faae1283ef570076

SHA256
65991a8016b2ee0473c80dc9a4c9705035bb144a770eae5238b6582e3648b9fb

SHA512
8186ee8d711cf8fc064defb9a346adbcc90073e598191cd8badb9c71ba53f45394aa6ebb73e0e3c5d392a9379037b200de6a84fc1f8d4a7650e2b3586976db2f

Download Submit
memory/2560-50-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2560-48-0x0000000003890000-0x0000000003C02000-memory.dmp

Filesize
3.4MB

Download
memory/2560-47-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2560-0-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-10-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-67-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-55-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-75-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-79-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-49-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-21-0x0000000003970000-0x0000000003CE2000-memory.dmp

Filesize
3.4MB

Download
memory/2572-51-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-65-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-57-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2596-41-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2596-45-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2716-46-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2716-22-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-52-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-53-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-58-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-60-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-64-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-54-0x0000000003830000-0x0000000003BA2000-memory.dmp

Filesize
3.4MB

Download
memory/2752-66-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-40-0x0000000003830000-0x0000000003BA2000-memory.dmp

Filesize
3.4MB

Download
memory/2752-68-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-70-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-33-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2752-56-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download