Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 12:09

General

  • Target

    SearchIndexer.exe

  • Size

    3.6MB

  • MD5

    f2997dfb6f126670204c83344b678f0e

  • SHA1

    fb1a90117ff594cac3b2cebbbbd072674f246ce3

  • SHA256

    73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0

  • SHA512

    20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad

  • SSDEEP

    98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Detect Neshta payload 3 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:932
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:612
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:560
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1548
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\explorer.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1920
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2324
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1888
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HblWKWAsB8.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:236
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2464
          • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe
            "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2420
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1644
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2680
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1896
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2772
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2672
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2396
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2964
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1076
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1536
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1604
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1540
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:736
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchIndexerS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2148
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1876
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchIndexerS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

    • C:\Users\Admin\AppData\Local\Temp\HblWKWAsB8.bat

      Filesize

      188B

      MD5

      c24786d53a55a51bcee7005b5a333a8b

      SHA1

      97177d74fabfa948a256d0936d35243a65982da3

      SHA256

      d5fe58003d6adbba5829b81ce0b8962aaab4598d6c6cef54c763e151ccf4294c

      SHA512

      d991ac22afd98558d31f368f3679658da9fb81bf43c0830813f45e3d00347e60b8d74c4319a56ca0f346c5844cd1dba9cc26eb3d451707c488789f19a87c3a79

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      0dbbb787c99bfe8b9f07587cebf2d9b7

      SHA1

      c82fe00c5a3ee412513b811ca5c4a97fe6456412

      SHA256

      89f0456eda0f1b49d2ba2305b1d7949329255a67651dd4d6feaf85bab6aa376f

      SHA512

      dec0f3ca9835413d52440a80ae842a7f6a5de4fc8a14d0813f355880741ac307dfd0b38ab4fe450cdfa85a3103fca28ed2f2fff958e38aeb82b74255afe1eaa0

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    • \Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe

      Filesize

      3.5MB

      MD5

      3e3fe7663181211e5983da48431ddf33

      SHA1

      0bea67a96dba0798541ea15426fb0ac38c10ff06

      SHA256

      cc398c54d30b3c0c1ff1d54f03fb157578346d088c9ce38fc6347698f25fc166

      SHA512

      80056c508dade773729c239bd0b43d92c9e6d8de513b19776bf28665e37e44d022fd6c5f33ebfa3fe31b9480ce0705e9581d872b8e79703931da459d4f5922a0

    • memory/1656-160-0x0000000001E10000-0x0000000001E18000-memory.dmp

      Filesize

      32KB

    • memory/1656-159-0x000000001B720000-0x000000001BA02000-memory.dmp

      Filesize

      2.9MB

    • memory/2376-113-0x000000001AAB0000-0x000000001AAC2000-memory.dmp

      Filesize

      72KB

    • memory/2376-121-0x000000001B080000-0x000000001B0DA000-memory.dmp

      Filesize

      360KB

    • memory/2376-95-0x0000000000590000-0x00000000005AC000-memory.dmp

      Filesize

      112KB

    • memory/2376-97-0x00000000002B0000-0x00000000002C0000-memory.dmp

      Filesize

      64KB

    • memory/2376-99-0x0000000000A50000-0x0000000000A68000-memory.dmp

      Filesize

      96KB

    • memory/2376-101-0x0000000000570000-0x0000000000580000-memory.dmp

      Filesize

      64KB

    • memory/2376-103-0x0000000000580000-0x0000000000590000-memory.dmp

      Filesize

      64KB

    • memory/2376-105-0x0000000000A70000-0x0000000000A7E000-memory.dmp

      Filesize

      56KB

    • memory/2376-107-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

      Filesize

      72KB

    • memory/2376-109-0x0000000000A80000-0x0000000000A90000-memory.dmp

      Filesize

      64KB

    • memory/2376-111-0x000000001AA90000-0x000000001AAA6000-memory.dmp

      Filesize

      88KB

    • memory/2376-91-0x00000000002C0000-0x00000000002E6000-memory.dmp

      Filesize

      152KB

    • memory/2376-115-0x0000000000A90000-0x0000000000A9E000-memory.dmp

      Filesize

      56KB

    • memory/2376-117-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/2376-119-0x0000000000B50000-0x0000000000B60000-memory.dmp

      Filesize

      64KB

    • memory/2376-93-0x00000000002A0000-0x00000000002AE000-memory.dmp

      Filesize

      56KB

    • memory/2376-123-0x0000000000BE0000-0x0000000000BEE000-memory.dmp

      Filesize

      56KB

    • memory/2376-125-0x0000000000BF0000-0x0000000000C00000-memory.dmp

      Filesize

      64KB

    • memory/2376-127-0x00000000011E0000-0x00000000011EE000-memory.dmp

      Filesize

      56KB

    • memory/2376-129-0x000000001AAF0000-0x000000001AB08000-memory.dmp

      Filesize

      96KB

    • memory/2376-131-0x000000001AAD0000-0x000000001AADC000-memory.dmp

      Filesize

      48KB

    • memory/2376-133-0x000000001B0E0000-0x000000001B12E000-memory.dmp

      Filesize

      312KB

    • memory/2376-48-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

      Filesize

      9.9MB

    • memory/2376-47-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

      Filesize

      9.9MB

    • memory/2376-15-0x00000000011F0000-0x000000000157E000-memory.dmp

      Filesize

      3.6MB

    • memory/2376-164-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

      Filesize

      9.9MB

    • memory/2376-14-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

      Filesize

      4KB

    • memory/2420-238-0x0000000001090000-0x000000000141E000-memory.dmp

      Filesize

      3.6MB

    • memory/3036-233-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3036-235-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB