Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 15:49

General

  • Target

    http://154.213.192.50

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://154.213.192.50
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
      2⤵
        PID:3460
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
        2⤵
          PID:452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
          2⤵
            PID:2552
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
            2⤵
              PID:1592
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:5088
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
                2⤵
                  PID:1812
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2524
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                  2⤵
                    PID:4492
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                    2⤵
                      PID:4044
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                      2⤵
                        PID:3012
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                        2⤵
                          PID:4716
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
                          2⤵
                            PID:1772
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                            2⤵
                              PID:2788
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
                              2⤵
                                PID:896
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2508
                              • C:\Users\Admin\Downloads\SRBMiner-MULTI.exe
                                "C:\Users\Admin\Downloads\SRBMiner-MULTI.exe"
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1608
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c set
                                  3⤵
                                    PID:3760
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13026248496535431897,4936633657095276054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4136 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:704
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4976
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:5052

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    e4f80e7950cbd3bb11257d2000cb885e

                                    SHA1

                                    10ac643904d539042d8f7aa4a312b13ec2106035

                                    SHA256

                                    1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                    SHA512

                                    2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    2dc1a9f2f3f8c3cfe51bb29b078166c5

                                    SHA1

                                    eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                    SHA256

                                    dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                    SHA512

                                    682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    7bf6586b552cce9b1f1fa174a1945bf5

                                    SHA1

                                    744f2ac1bad2731800b17a1030cc3a84b3792335

                                    SHA256

                                    b19ffd83a414ecc937ab1c25f3b9cde5a7d1f17fb036ed509cc7d6a5773cf744

                                    SHA512

                                    0fb9eb60e872153c932db6fe0d411d7b94dd1c8b13e448e44ed77fa3b9e501766144f76781bf3476c12e391c0316ea2a208d2a01a39262d97f9eb4b0b6ba70cb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    81d416f822c79ac7c205ca7454d09c9e

                                    SHA1

                                    fa3fbf984767b08f82144f1af509f7c660d2ed35

                                    SHA256

                                    a9054b407a34824c3f109400e0c499573c2e5f9c9334ce3188e130469db49aa8

                                    SHA512

                                    493fb4f11fc6e7fdfddc0c3910d4682ec8739eac49f1d78dff195050f3c0178dcf7fdd65653cd7f1324633d7cfe76d156c13d799d7e07ec80855f9a72c636dd4

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    598d206ec7d0e55906a75eda336c2e4a

                                    SHA1

                                    fcdbc11d7a8e7ccd4e801e069702d6658320ac8f

                                    SHA256

                                    608f745e8a37d2ec8c5b703df71680f55c86167f4e6c0383b683e195afd2a21c

                                    SHA512

                                    4b635cef76ab48a7e22791ee4572b322ea85a5f6570d062d4de7f81ecbb5e31ec56580a432397928de7fd2bc50b0e4925efa8a0852a3390db9427f1b48334ae9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    340069b6663e903a107074fb10a1580b

                                    SHA1

                                    d6b2fceeb0fa00a8c66c5659f8f85770968bf4a2

                                    SHA256

                                    e49a5ca618c10c8a3e79ed1d49fa5ba78c156235a1976bfe9d91b8638cdbe445

                                    SHA512

                                    345e9f4d051f40f64664915e12a8cde8185883fab79642eb51c98411ade9884c455d18365753fe91759957d9eca832b36b35b2cc7c3c3874334fb50c739fbdec

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    7ec764d4ae64733ebdefb6d931a06fba

                                    SHA1

                                    b8552c076e424d7444ea32bac9d4aa49211f8254

                                    SHA256

                                    0e04e4af854ddbc1767a887317ef021d3b2d94d3accd25b3473d79c1e66945f0

                                    SHA512

                                    22d771d7406df50a64e092725610b42b042eaab23781c918b45ab6aaf895ccf8207a45d3b0b890e82bcbd41bb0eec0664e48d06e09cae6b00a94b94d0105f429

                                  • C:\Users\Admin\AppData\Local\Temp\evb7C31.tmp

                                    Filesize

                                    1KB

                                    MD5

                                    4998c826b605ee77c13a2018618facb4

                                    SHA1

                                    6c60755c430669f9d4c14c63001b222a53a5b5fb

                                    SHA256

                                    145450471b410b8b6dac975d43f0b9dbcda06747ac41b87e93fb33c3d7f77e3c

                                    SHA512

                                    9dc7fdfbc26fe06599c70d2999952fe64d19faa39896e32a7f10e8c765f51bc9670569eb702de43e426a2fad36ac5a4a9955d415523ccda5733af8f741b7dec2

                                  • C:\Users\Admin\AppData\Local\Temp\evb7C51.tmp

                                    Filesize

                                    1KB

                                    MD5

                                    ca71ec205cde2578292b6b7afc68af7a

                                    SHA1

                                    176960a041c3faa545ee95835ea23b3bd6ebefff

                                    SHA256

                                    a9356cd19cf5f28575aa2531b900711fcf229505cb07381f8de30c210b62e09c

                                    SHA512

                                    2cb22f163f4e7b5d77254113f81a54918fd0bf21004f41f783216031759e97693eb58230532edb918b1e5dc3a0fff80f06b5504e88c386721dc0934809bbd0b4

                                  • C:\Users\Admin\AppData\Local\Temp\evb7C81.tmp

                                    Filesize

                                    1KB

                                    MD5

                                    be10ecef22e448c25fa481e75cab6f14

                                    SHA1

                                    6205232aa5d8fafa2aa3d7101221372d4ec979e1

                                    SHA256

                                    02d479a16dd1b7d35718422d579e4cf8800b17c89bbed276e0c4d7fa5bf07eba

                                    SHA512

                                    d33ed5bc85adf6cefc9a6fa949c3055ecdb7fb8058766772bdd5065b97f8e6a797474980039435b96d315c4b8e9f46d270b149e2fe216677a924cedb8eb75072

                                  • C:\Users\Admin\Downloads\Unconfirmed 232469.crdownload

                                    Filesize

                                    35.3MB

                                    MD5

                                    41adf91275e99d2cd721804386bee1f0

                                    SHA1

                                    20c5471bd9af8e2699674cd935bdf008d51b4340

                                    SHA256

                                    df2a94d2a619974ad7d6cd8a9093e925a0ca9bb654e67bffe31e5ed87a3287d0

                                    SHA512

                                    a1f3ba0cde3a88b17279d5c9df071cd1658dc43cfc3d05413d5afcbe7dc16bedbf61af1156ef8cf6dc2cc948796cd64ef4b959cc9306822d6b8f48b42a7ad6be

                                  • memory/1608-135-0x00000002E3650000-0x00000002E3666000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/1608-139-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-134-0x000000037C1A0000-0x000000037C231000-memory.dmp

                                    Filesize

                                    580KB

                                  • memory/1608-132-0x00000002E3650000-0x00000002E3666000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/1608-118-0x0000000356B30000-0x0000000356DE3000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/1608-124-0x0000000356B30000-0x0000000356DE3000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/1608-106-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-136-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-133-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-137-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-138-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-127-0x000000037C1A0000-0x000000037C231000-memory.dmp

                                    Filesize

                                    580KB

                                  • memory/1608-140-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-147-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-151-0x00000002E3650000-0x00000002E3666000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/1608-149-0x0000000356B30000-0x0000000356DE3000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/1608-148-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-170-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-174-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-182-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-186-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-192-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-198-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB

                                  • memory/1608-202-0x0000000140000000-0x0000000144393000-memory.dmp

                                    Filesize

                                    67.6MB