Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 14:22

General

  • Target

    d95c6d2b0c1dd1f95ea5810e4a0bfa0fbfa5a626a26bdf64907b5b26654bbf7f.exe

  • Size

    1.3MB

  • MD5

    5e2c32f1f985780b05f8e27a12974695

  • SHA1

    f773e2e9a56b8011cd4606e1593da3d0c2ac70ca

  • SHA256

    d95c6d2b0c1dd1f95ea5810e4a0bfa0fbfa5a626a26bdf64907b5b26654bbf7f

  • SHA512

    ac4fe96551845033f0d800a2dcb1177426e74322309a47d5bab441d1d205e710d6b4b60ed8309409b5c45d77c403ce32c9427fd64d56d2f068df219430d8f0d8

  • SSDEEP

    24576:myEPmuKRD+EPw3NpjZI3CN3PEEjIdTYsupa/lvKTXAdl8l3hfDh6T8tOcpEIHvl:1AmuaCZ3vjZI3CZcNJYGlvKTwd+1hjtn

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 17 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d95c6d2b0c1dd1f95ea5810e4a0bfa0fbfa5a626a26bdf64907b5b26654bbf7f.exe
    "C:\Users\Admin\AppData\Local\Temp\d95c6d2b0c1dd1f95ea5810e4a0bfa0fbfa5a626a26bdf64907b5b26654bbf7f.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2528
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2476
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2532
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 272
                  8⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe

    Filesize

    1.2MB

    MD5

    3a9e98fdd979ad9b8d4ed07d3fa5922b

    SHA1

    4f7c4bb010d20609ffcd0423efe8d5d1b16d8f06

    SHA256

    6bc2d07cad5fa0f33da01724cc2a776b44aed292ce4d2262ab5f0e6069f8b4e3

    SHA512

    d1ca3eae5074b7597d8defe68210d16f6d3fbe608a492516e2e3097bd56499efaf855a0a178ee345fa9d7f063109c6a6810232b81862d4575ea05baea60dc2cf

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe

    Filesize

    1.2MB

    MD5

    3a9e98fdd979ad9b8d4ed07d3fa5922b

    SHA1

    4f7c4bb010d20609ffcd0423efe8d5d1b16d8f06

    SHA256

    6bc2d07cad5fa0f33da01724cc2a776b44aed292ce4d2262ab5f0e6069f8b4e3

    SHA512

    d1ca3eae5074b7597d8defe68210d16f6d3fbe608a492516e2e3097bd56499efaf855a0a178ee345fa9d7f063109c6a6810232b81862d4575ea05baea60dc2cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe

    Filesize

    953KB

    MD5

    93458ea6f5f4ffa0a036c50f6a620063

    SHA1

    a6af3ae532ae57855c44d4818e03648fb986cfaf

    SHA256

    3245891e3a4e574aa1cf5d00fe1ccbbeaba19b8a6fdf2ee8201aa04b71ad5feb

    SHA512

    dc925e0cd273462ddcd39e66fd6c8f92f44cf87c121a1034b48492c16c654007ce81515136105fa2cc47aa3f88724b2ddf98051ebaab666db6f398a0ac70d8ec

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe

    Filesize

    953KB

    MD5

    93458ea6f5f4ffa0a036c50f6a620063

    SHA1

    a6af3ae532ae57855c44d4818e03648fb986cfaf

    SHA256

    3245891e3a4e574aa1cf5d00fe1ccbbeaba19b8a6fdf2ee8201aa04b71ad5feb

    SHA512

    dc925e0cd273462ddcd39e66fd6c8f92f44cf87c121a1034b48492c16c654007ce81515136105fa2cc47aa3f88724b2ddf98051ebaab666db6f398a0ac70d8ec

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe

    Filesize

    797KB

    MD5

    44d00c9555c4538623e36028dcefbf6c

    SHA1

    8c934174af6109f8f808deb1ff9c3a3c560f4b3b

    SHA256

    bfdd8d6027d11696b6c5aff1c68451f289bd89b6b3fd6e826c30373db607fbe2

    SHA512

    0dd6345371f9a17e4d0c8adab0f208d27d988d07434ba58980fd027c6df839f44a96bebf66b438840186e349a126ca26f83172bcb9e78869cb50ec9b92cacaf9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe

    Filesize

    797KB

    MD5

    44d00c9555c4538623e36028dcefbf6c

    SHA1

    8c934174af6109f8f808deb1ff9c3a3c560f4b3b

    SHA256

    bfdd8d6027d11696b6c5aff1c68451f289bd89b6b3fd6e826c30373db607fbe2

    SHA512

    0dd6345371f9a17e4d0c8adab0f208d27d988d07434ba58980fd027c6df839f44a96bebf66b438840186e349a126ca26f83172bcb9e78869cb50ec9b92cacaf9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe

    Filesize

    631KB

    MD5

    52754dc753b7499e8572d65bfcd72680

    SHA1

    05bce1d0335b321a598de9fafe5c713a568ee48c

    SHA256

    fc9d5a1887448ebe0e4f8a93a0adfd53988b0d2a8e28087a1dea79e32d44da87

    SHA512

    12184f515ee249a5649fc3cd75267b2e3d9b9d01225e4e4d1f7e9f1c62d4b3e881e3ccc731ff4286ac3110c1df17eba009f833ce5b25ccbdfa8371347e3c678b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe

    Filesize

    631KB

    MD5

    52754dc753b7499e8572d65bfcd72680

    SHA1

    05bce1d0335b321a598de9fafe5c713a568ee48c

    SHA256

    fc9d5a1887448ebe0e4f8a93a0adfd53988b0d2a8e28087a1dea79e32d44da87

    SHA512

    12184f515ee249a5649fc3cd75267b2e3d9b9d01225e4e4d1f7e9f1c62d4b3e881e3ccc731ff4286ac3110c1df17eba009f833ce5b25ccbdfa8371347e3c678b

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe

    Filesize

    354KB

    MD5

    45259fcd08cc473ef0f912937c8387f2

    SHA1

    043bb27eb6e6f9694ec9c1faf304a2e5d7669856

    SHA256

    1582e35636a8be1354e6abb94949442119ef29debb1ac5c6e370d1bbafdd40c7

    SHA512

    29c3c6c7ea6ec91a298ac06a8d4180499e8d590b422d16c601179c7fcdd189f900529ff6d121e0a5b9ee196c0481cc078971c0e77f368f1bba9d4651636a6dc2

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe

    Filesize

    354KB

    MD5

    45259fcd08cc473ef0f912937c8387f2

    SHA1

    043bb27eb6e6f9694ec9c1faf304a2e5d7669856

    SHA256

    1582e35636a8be1354e6abb94949442119ef29debb1ac5c6e370d1bbafdd40c7

    SHA512

    29c3c6c7ea6ec91a298ac06a8d4180499e8d590b422d16c601179c7fcdd189f900529ff6d121e0a5b9ee196c0481cc078971c0e77f368f1bba9d4651636a6dc2

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe

    Filesize

    1.2MB

    MD5

    3a9e98fdd979ad9b8d4ed07d3fa5922b

    SHA1

    4f7c4bb010d20609ffcd0423efe8d5d1b16d8f06

    SHA256

    6bc2d07cad5fa0f33da01724cc2a776b44aed292ce4d2262ab5f0e6069f8b4e3

    SHA512

    d1ca3eae5074b7597d8defe68210d16f6d3fbe608a492516e2e3097bd56499efaf855a0a178ee345fa9d7f063109c6a6810232b81862d4575ea05baea60dc2cf

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v7774545.exe

    Filesize

    1.2MB

    MD5

    3a9e98fdd979ad9b8d4ed07d3fa5922b

    SHA1

    4f7c4bb010d20609ffcd0423efe8d5d1b16d8f06

    SHA256

    6bc2d07cad5fa0f33da01724cc2a776b44aed292ce4d2262ab5f0e6069f8b4e3

    SHA512

    d1ca3eae5074b7597d8defe68210d16f6d3fbe608a492516e2e3097bd56499efaf855a0a178ee345fa9d7f063109c6a6810232b81862d4575ea05baea60dc2cf

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe

    Filesize

    953KB

    MD5

    93458ea6f5f4ffa0a036c50f6a620063

    SHA1

    a6af3ae532ae57855c44d4818e03648fb986cfaf

    SHA256

    3245891e3a4e574aa1cf5d00fe1ccbbeaba19b8a6fdf2ee8201aa04b71ad5feb

    SHA512

    dc925e0cd273462ddcd39e66fd6c8f92f44cf87c121a1034b48492c16c654007ce81515136105fa2cc47aa3f88724b2ddf98051ebaab666db6f398a0ac70d8ec

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v3670612.exe

    Filesize

    953KB

    MD5

    93458ea6f5f4ffa0a036c50f6a620063

    SHA1

    a6af3ae532ae57855c44d4818e03648fb986cfaf

    SHA256

    3245891e3a4e574aa1cf5d00fe1ccbbeaba19b8a6fdf2ee8201aa04b71ad5feb

    SHA512

    dc925e0cd273462ddcd39e66fd6c8f92f44cf87c121a1034b48492c16c654007ce81515136105fa2cc47aa3f88724b2ddf98051ebaab666db6f398a0ac70d8ec

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe

    Filesize

    797KB

    MD5

    44d00c9555c4538623e36028dcefbf6c

    SHA1

    8c934174af6109f8f808deb1ff9c3a3c560f4b3b

    SHA256

    bfdd8d6027d11696b6c5aff1c68451f289bd89b6b3fd6e826c30373db607fbe2

    SHA512

    0dd6345371f9a17e4d0c8adab0f208d27d988d07434ba58980fd027c6df839f44a96bebf66b438840186e349a126ca26f83172bcb9e78869cb50ec9b92cacaf9

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v3496705.exe

    Filesize

    797KB

    MD5

    44d00c9555c4538623e36028dcefbf6c

    SHA1

    8c934174af6109f8f808deb1ff9c3a3c560f4b3b

    SHA256

    bfdd8d6027d11696b6c5aff1c68451f289bd89b6b3fd6e826c30373db607fbe2

    SHA512

    0dd6345371f9a17e4d0c8adab0f208d27d988d07434ba58980fd027c6df839f44a96bebf66b438840186e349a126ca26f83172bcb9e78869cb50ec9b92cacaf9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe

    Filesize

    631KB

    MD5

    52754dc753b7499e8572d65bfcd72680

    SHA1

    05bce1d0335b321a598de9fafe5c713a568ee48c

    SHA256

    fc9d5a1887448ebe0e4f8a93a0adfd53988b0d2a8e28087a1dea79e32d44da87

    SHA512

    12184f515ee249a5649fc3cd75267b2e3d9b9d01225e4e4d1f7e9f1c62d4b3e881e3ccc731ff4286ac3110c1df17eba009f833ce5b25ccbdfa8371347e3c678b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v8005165.exe

    Filesize

    631KB

    MD5

    52754dc753b7499e8572d65bfcd72680

    SHA1

    05bce1d0335b321a598de9fafe5c713a568ee48c

    SHA256

    fc9d5a1887448ebe0e4f8a93a0adfd53988b0d2a8e28087a1dea79e32d44da87

    SHA512

    12184f515ee249a5649fc3cd75267b2e3d9b9d01225e4e4d1f7e9f1c62d4b3e881e3ccc731ff4286ac3110c1df17eba009f833ce5b25ccbdfa8371347e3c678b

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe

    Filesize

    354KB

    MD5

    45259fcd08cc473ef0f912937c8387f2

    SHA1

    043bb27eb6e6f9694ec9c1faf304a2e5d7669856

    SHA256

    1582e35636a8be1354e6abb94949442119ef29debb1ac5c6e370d1bbafdd40c7

    SHA512

    29c3c6c7ea6ec91a298ac06a8d4180499e8d590b422d16c601179c7fcdd189f900529ff6d121e0a5b9ee196c0481cc078971c0e77f368f1bba9d4651636a6dc2

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\v9380555.exe

    Filesize

    354KB

    MD5

    45259fcd08cc473ef0f912937c8387f2

    SHA1

    043bb27eb6e6f9694ec9c1faf304a2e5d7669856

    SHA256

    1582e35636a8be1354e6abb94949442119ef29debb1ac5c6e370d1bbafdd40c7

    SHA512

    29c3c6c7ea6ec91a298ac06a8d4180499e8d590b422d16c601179c7fcdd189f900529ff6d121e0a5b9ee196c0481cc078971c0e77f368f1bba9d4651636a6dc2

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a7028297.exe

    Filesize

    250KB

    MD5

    b12875989fea5154a1c051ff272a59ba

    SHA1

    12c36d4bb9a1e8b208f610c8de37394b45c51b26

    SHA256

    50d6125599f715d4bbfc8f422397b2258aa5cba0f1fc7169b37184912c249038

    SHA512

    4a75fe1e65e578cfbeef8c95a6ff9adf36555761f6dbd7c94b4335801eed53dd873933e2f17cce0c1c8bb4d5d4939bd345d72a5593583f50c5d81bd6a595a989

  • memory/2532-68-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2532-70-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-72-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-66-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-65-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2532-63-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB