Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/08/2024, 18:50

240823-xhew3azhjb 10

23/08/2024, 18:47

240823-xfkpjazgja 8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 18:47

General

  • Target

    that_is_lgrachov.jpeg

  • Size

    27KB

  • MD5

    f085fe12d8ebb8b7783f6d734e9bac29

  • SHA1

    35cc62e74855c6e3235715fbda3fac4951d421a6

  • SHA256

    1846a6270fbbb0fc3fd55788699ac1acc3cb6b339bd8ad004ddbf32dd41e6fd2

  • SHA512

    b8a138236eeb09fca969f88d7034d8c1ac0b93b58b71ce25a19c6b8174cd0e46ff6bbca8e6603cd6bf3228bd100d2d2fa8f3ab13696687fb6e200de739af73ec

  • SSDEEP

    768:iIPPEs/U7nXOU5tZJIyW1crMvPxHvedPvHG3:iURqXOoKgYvpenHG3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\that_is_lgrachov.jpeg
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3008
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.0.428504826\191322240" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b762c783-3467-40e0-a6df-66983a63dfec} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 1280 110bb758 gpu
        3⤵
          PID:2668
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.1.75387657\350902606" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5571804-647a-48b8-aae2-5cb2f41427b7} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 1484 d72558 socket
          3⤵
            PID:2720
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.2.1316097960\211859455" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {806fc063-97c5-426a-8943-faa7d34d9f21} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 2088 1a48e258 tab
            3⤵
              PID:1224
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.3.277842479\205272915" -childID 2 -isForBrowser -prefsHandle 2396 -prefMapHandle 2388 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {588d201c-9629-4b78-8ac0-91a6028618e6} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 2300 19243e58 tab
              3⤵
                PID:1592
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.4.1502344780\1103482293" -childID 3 -isForBrowser -prefsHandle 2396 -prefMapHandle 2716 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebdc7313-aaa7-42c7-932c-78ee5b1170ec} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 2960 d62b58 tab
                3⤵
                  PID:2836
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.5.1589569715\109569835" -childID 4 -isForBrowser -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd27c8f4-3a71-48bc-a349-e348560797fd} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 3876 1fe41b58 tab
                  3⤵
                    PID:2636
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.6.1188011836\437048821" -childID 5 -isForBrowser -prefsHandle 3984 -prefMapHandle 3988 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ffd5d50-213a-46fb-a80e-26c206c9ec85} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 3972 1fe42458 tab
                    3⤵
                      PID:2540
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.7.702975076\614864755" -childID 6 -isForBrowser -prefsHandle 4164 -prefMapHandle 4168 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c675710-7a51-44c5-989f-a575dc431191} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 4152 1fe42d58 tab
                      3⤵
                        PID:1808
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.8.917096443\2100815459" -childID 7 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2335e526-2e82-4c61-81e3-909c10ab8a39} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 4196 21725c58 tab
                        3⤵
                          PID:1284
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.9.1974993709\1366209114" -childID 8 -isForBrowser -prefsHandle 3988 -prefMapHandle 3984 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48facd43-945f-45e1-820d-9ef4eb40e6ab} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 4480 21851758 tab
                          3⤵
                            PID:2596

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\39ptzwfm.default-release\activity-stream.discovery_stream.json.tmp

                        Filesize

                        40KB

                        MD5

                        983c0a7c1d250a025a7854a837e491e2

                        SHA1

                        82b8706668c18ed8dea85ff69906c27ce25d4345

                        SHA256

                        7012ebf9f71c3ea6ce53a7917041975f59bf0694d96a44c34a72e8f04bc31e3c

                        SHA512

                        0c3e750f55d79a6986adc07feef74d8bd7c7cb021af03e794ce39efc71f94d75049c5d558efd200eece280d9c496b500295408eb7bbd5ded97cf83bf7652aa52

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\39ptzwfm.default-release\thumbnails\25d4c6e41df7d98f78dff451d1027fbf.png

                        Filesize

                        7KB

                        MD5

                        6cba1f82eecd2f65ae34e89a3f1198cd

                        SHA1

                        63b80a1bb62921ff82ebb5745b5301d699ed332c

                        SHA256

                        a93763b54b86fe49afb30e84df3a6da920d645eb96eca033b336be640e800d2c

                        SHA512

                        acacf71b308df6bd89a0e26cfe1ee09b9cd9b34391882b8dcdd1239ee5a917f2749a56d9cdea0699f30fa9c3815680c3d042d36a19a09dc74e6a03439bfad7ca

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\db\data.safe.bin

                        Filesize

                        2KB

                        MD5

                        e6c2cff312154134dad537521a6cc767

                        SHA1

                        400a1d135be468a926295f2496e4470a1c198a5d

                        SHA256

                        1533664581b5a8ab3495510f03f76f2816a13f86e1cb0e20eab07d7289f80506

                        SHA512

                        58d40e7ab673b6641f3eb76d669c31220fcb172d7c584f763279547d88f908d47fb0e6459bcc2811d2105c505a0a2e2b5077ec38d754cca3890c1b720ca56b3d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\pending_pings\0ebf3b25-2ba5-41a0-8076-2d2d9f50367f

                        Filesize

                        12KB

                        MD5

                        3d42dea4cf1b98923a5364ea9b596693

                        SHA1

                        e89776d37300a8fb992b5829d05aa0fc3e43d937

                        SHA256

                        d6c1b849eb2d836490399d2c1bd9438b2e00337a8cb2c3ae7ed8e3e3e592e24b

                        SHA512

                        26e4f5bbf278e62bf6a81ab0cc785cdbe028855c0f589224ebc7aa20fb83de1cf08373aed3812a00156d4c19e12a4016a4d006a8ae194d4a00f547a66cce24b8

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\pending_pings\b78a71fa-de2e-4ffe-9d45-060cf64725b6

                        Filesize

                        745B

                        MD5

                        316509e01b11479f6446004ffc0fd017

                        SHA1

                        ae553370bc37210d9c03aa5c41479ae0e2287f91

                        SHA256

                        3e0b10f6784fb4baf93b532ca10debe83aaeead4d74ca4d1dd92e19fecacfc1e

                        SHA512

                        a9389e7b94bb4ff66313ce6c263657de1ca5dba4cb942929a78ba6be09bc7196bd7967cb0fe53bb6cc704e17ce4bee39d5629959b41d4879a0cf61b816306952

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        9f06244ed69720cff53f52ab21a0deed

                        SHA1

                        820eeb2c9f53fdc6380779053a47e5144b1b12e7

                        SHA256

                        d1c8e5e49b9290fa0901a52847f3660e53e03b6fab77f3c1ee8f12a4905af400

                        SHA512

                        086be66e8f5284d0808b351c8f6710efe5e920777d99ee2c26f5dc82009a8e942e03babc035a8c737986ea2ff0d08fc1f98bd8e93e1d5eb68b04066b3e9d73e2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        a06597c2ffc1adb464e2643c8406f966

                        SHA1

                        a79c7f4de76ec328d64697d1f3a8df348e66fef8

                        SHA256

                        94feeb1d7a4676a2d86e9e6d8311b2103ba3c8c3d2b4ffee3d8bdc6649ee2a17

                        SHA512

                        8ad4e606c61a439abe7cb74817e6ed3796490e57b3bf52b9d3a020b69495e99a8692901b8d6b0296a3bbe604d9cc6288c7881edaf597e103f1832f00a1b425cf

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        ab4b860a5ece4aaa60c1c50be536286c

                        SHA1

                        adbad3237f9b51fcea2eece9b7c3a61f7405f21f

                        SHA256

                        394935f1223ab4e0f215803da8778e26c75df74a88e0ccacda7e57a2af24c78a

                        SHA512

                        2ace548fefb23c73a672f7edcf1ae1f77af563aaeede3c3ad4fb92e553cf6062546ddbe87804c1f9fc0ab1e03e79539bc10cef8302c10380b77137198a71c358

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        707da8b0be2564455f81042df43a7331

                        SHA1

                        184f6a469242eb3e07b0230e82f35c8117f9626d

                        SHA256

                        ba02fab5a8cdb3f3095177ae52dde4a827454b5ca95a64a320129b0703572bac

                        SHA512

                        af73db732de085c4c3ac708e6e712c9084ad312d64d0b9e0e1f726ddee18447c9d0216c6d2ec8a7d6a035f80623f97c0dbdcdafab0b942eff5a0a45efb74f8b0

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        2KB

                        MD5

                        702bef8a4fb8c514c7a258f56c05bf7d

                        SHA1

                        306e4c7f2a5511f7a34bd49a8b22b405240eeb5b

                        SHA256

                        fadd8867239534e90d9aa6673b696f1d7df69deba3b7ff7787ead9aaf5406e5d

                        SHA512

                        f61145767429e279835704530e4c66a276cca08189183f56de25f225414fd5e27df30e7950c42f5128d646e913f7215203b5f8e5dbfcdf2b28367a0fb80cc171

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        2KB

                        MD5

                        4fac8d7cf241dec49c1c40e747878bec

                        SHA1

                        d22f3441888c1cebb929def44e396f5a9d3d8a11

                        SHA256

                        b2fbc8b1c07f107a285c710c96bafdb92f9fb79f87be542e9cdea8d129c2c78b

                        SHA512

                        1e1869aee96dc8b3dfa519b6fb76a4a4960323af63600bc6e1cdd23f4cd185f1a1f3b919701095d50312d926711d6df0a7eb7d5f3a61a8bc733666bebef6f164

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        184KB

                        MD5

                        6ea00f6dd382575041f76085178b59e2

                        SHA1

                        3612cc8e6a41215289e9ca8531ab4040d7008c9a

                        SHA256

                        19a773b2866eb435b715555cb48ad980f45b97bb98878e083982dcc7d21103b4

                        SHA512

                        57d91605446a1348b6e56483f8ff2bb4d9748a650bdb21f4482d8f2b0dd7823eb328dd2b883f9e916bb20a8b2487dced9b1efb87db773bb983ccac931d32becc

                      • memory/3008-0-0x0000000000190000-0x0000000000191000-memory.dmp

                        Filesize

                        4KB

                      • memory/3008-1-0x0000000000190000-0x0000000000191000-memory.dmp

                        Filesize

                        4KB