Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 06:20

General

  • Target

    2b48becf815c20c289d32fb8eb8cc7f2_JaffaCakes118.exe

  • Size

    405KB

  • MD5

    2b48becf815c20c289d32fb8eb8cc7f2

  • SHA1

    03adb9b2e9c96681b1e593ed80c7ecf9967cc621

  • SHA256

    010d0a9549776bb470ca5acaa62e3ff23b66356f16be006d00af731932fb027b

  • SHA512

    8ee6fde3a7f2303153ab9f7145e15e5f4a7039480f9ebe33bbb117ecc3b5592a98966222e915a6f394dbcb488df19f72b6062a9c316cd291856f311f1b253851

  • SSDEEP

    12288:vxbKLvWnmc+85UImXNf60kOy9st1t9vN:ZEvWnVH5FmXN8X9sN9vN

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Admin

C2

isniipezz.no-ip.info:555

Mutex

2FBF747FBMYJW4

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    updatet.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 30 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\2b48becf815c20c289d32fb8eb8cc7f2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2b48becf815c20c289d32fb8eb8cc7f2_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\twunk_32.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\explorer.exe
            explorer.exe
            4⤵
              PID:1492
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:1332
              • C:\Windows\twunk_32.exe
                "C:\Windows\twunk_32.exe"
                4⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:2876
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1520
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2904
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2308
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2260
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2156
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1732
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2572
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:324
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1628
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2912
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1508
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2804
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2864
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2688
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2868
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2672
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3036
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1740
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1872
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1004
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2056
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1560
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1132
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2508
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1400
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1640
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2580
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2924
                • C:\Windows\SysWOW64\install\updatet.exe
                  "C:\Windows\system32\install\updatet.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:972
              • C:\Windows\SysWOW64\install\updatet.exe
                "C:\Windows\system32\install\updatet.exe"
                4⤵
                • Executes dropped EXE
                PID:1936

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

          Filesize

          224KB

          MD5

          6ccc51efb4e2530570369b0cf66a78ce

          SHA1

          de0f7293392e8bcf17011525b6707e72d5b2475d

          SHA256

          835400801067954cbf1fa783d8df7853229816dd6065a4e2ad0194c8d6c6623f

          SHA512

          4f5ed6bcc382d225756bb810a31225b1665147aa0238ba56af041479646b6a351b68672f2282e56040f1f17f983f83a1870993da514c0b5a9445863069537c5b

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          306B

          MD5

          c9451f1a985779871eac0e11265c9864

          SHA1

          4fd3ec1451511c138c8c1a613a975985bda4c9aa

          SHA256

          2a85ff51baf829f5bd53f8c07eed2dacf346228c6a095bb46b0712ce7509c0bb

          SHA512

          d871cef9215f90946d60dbde378dd917e2ac37a2a1824b700ef9b6e1a7db0da2bed8514239d643c47d1f69f2e641ef2469c8f177d980c5dc6b476596fe17c63a

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          459B

          MD5

          8d36fddd581b4f2d9f217c7ae2ea6828

          SHA1

          729713bea7fc014ce2ecb265f371d24a6ac1d767

          SHA256

          5e782eef079219543190baba814ec6b601bff11a6ade44c7a83be3da9f5bd97f

          SHA512

          73e94bf0d26fd60b3c0db054c391b06dcd3d9f5dc16262fb60682896878436212fc4014faa09e3c80afe0c35be8231052685205c2b8543dd363844820dae041e

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          612B

          MD5

          9c82cd594d30455c114ed29d95cfd3c3

          SHA1

          8b08b3e852ba90a4d4b6879e9b70bb62a69ac4b5

          SHA256

          5e1a4aaf0b3b84a255018796679bd101589ef0b1c4cb4476762fb1cd85a506e1

          SHA512

          77a9e5229f87f446735f6df7e27a842ef6120222d00a24ec63e12842f6747fcf182b7fdb59a652ba281a73d40c74eedcfd86815d6e3e14cf118f1421202d2132

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          765B

          MD5

          c3210b5e7a546e37bb086707d1cb8fde

          SHA1

          ad684a796a4e7e3972db6647b7b00986ff4733c2

          SHA256

          84cc857706a65b374b713f5db348305e521c43e4a5d50904e241bdb939b6fcc4

          SHA512

          fcf92bb1a594c33562e004275220e445f4767f305046776582dea246407951c1fa8d1766646565f08c47e1bd1117a23570937b9eaaa99801d8d9eb31cd89d299

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          918B

          MD5

          73a52c932f479edbdb92b9c165f5c368

          SHA1

          cecf3d9fc40391c3f82aa206c1c64b5f0155cf06

          SHA256

          4fc6d0cbe20b27af6fa69b38701ae505b142be9411523bcae3e0c2aa35b3b132

          SHA512

          30dcb59191da6b2934186275767dbf7ad7818c87194ebb7262dc3972a8c590c7efac2fdfc8147526537badf317a0d63a2f88816f38883063f533ca5a66de9cad

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          fe164e8c0f5d0f4252be5b25fcc6dc88

          SHA1

          fa160614f22d7bd84bfa7df938141b7659b74158

          SHA256

          2c2e518de03fbaaa08323bf60880c4ae2d5417b42e856c96e79bcc7a4bf3c8f8

          SHA512

          578288a54ba54ec5a1c65c68662f6363b8631603afcd1441070a8951824fe8a826479da57e4681b974adb820a42cbd4f6c78ea94f9e7b401c392b624528d84f5

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          42c87def0c52645e64ffe6c819ac3166

          SHA1

          bc8f22b38573ec42ec36d3fb17a4f25d7376d4f7

          SHA256

          5a4c6fe25de3de61d3a35bad690720790a8a2d408c8d907de3ab1b3b93e224c8

          SHA512

          582ea8dcf83f74ef6c3c142ce8f91b3c0a337ecd2a664c01a5e9989eac16d85a39c897d9fbd3bebd36c7e3e410736f0e1d1a27dc50904ab03b2cf28a5738d2c9

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          7eab8efa3d126a69c1a92f99095f1c86

          SHA1

          f165a11de2785e237ab66d9aae0aa591948adfd1

          SHA256

          af98407c9882ae501ec7f5c9eac47033e39a493783cde16dbdf1e706dcb49971

          SHA512

          d6dda1bbfb9137fa174eb8f9f4331202732d90c46b61d15317ee1383fecb9adfa7248757fa29a1bf637ea3eb0975adf873eaf8c7abb66435934721f932645904

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          86bfcd4eb1a135b68ae9e57a8641fb96

          SHA1

          f3bd3a3471cfcdaf9f6a1b8d47130680ad77fa41

          SHA256

          c9a892cf56a76e617e9c422a45a6f2f8c5e970094d6ed257cb5abefa1564022d

          SHA512

          020bbf773326751919aad33465bd57024014e81f2b899675ddd6f62c81679678c41520d8580e0f1a65fc055caf0834be615993078f604ff362fd8316b95a59ea

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          5159f6471ada101363e8c27cd34fb3c7

          SHA1

          5de7f5c12912ce40c93a8ac3ac0932029b74de6e

          SHA256

          1c0be058a28e0cc66e0e2f77961a0adee50b2d1228e64970bb4260161139c106

          SHA512

          fd21f49d9ff4a2dea820d9525f7d0e1774f3ac23f9b855d5b269accbfbb4fe9d02075992d011bba8ad247dd47928417a202ba767f2c7aa2098bcc3eb5bd4d214

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          2420885780cf623f904a120585ba39fe

          SHA1

          64b5ba82bba7c8c7984966949d8d9292a43a3019

          SHA256

          8b94ab781d5da4053697536ab7579395bc9e5e5d23d9e54c685a51f8f1c16e09

          SHA512

          31115db6754428939f4fb608d6e86d0bd24eabb2eff60fcefc36def57ba694ab0c9507bc9ec7715dc1a5857c4f405f57071444c27e2804a7376fd2a64d8cc4e5

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          1KB

          MD5

          89e81697185fb7468962c2da3a54fd48

          SHA1

          024f51206c7eb7d80dd6784de12acb60011ec8f2

          SHA256

          aad76303b1bfb1ebc3e37d31f2b3f725da7f0b2a5bab7c764de62a7d44d2d15b

          SHA512

          763c9be6d94a8cd3914821e9c7a6510e5a2d10084bad4be36791463ce2255d403a8253464195d6d4ec0cc62d69e4d061db027d71214afb7e7b630d965aa2ca40

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          ee57819178472be044026c5dbd2b9a48

          SHA1

          9b9cfd30239f3d04924b30dbb4a665638392a7bf

          SHA256

          cb5d134f9801086616fa93dad2d63006f7f42737a1209e875631e5d32deed964

          SHA512

          31c8d7a3b5ed7ea2875a0b3e850a10e24321c6aeb573579a8cb3ace185110926f6373903eac588a9231318b9f74abeed9919d2952e0ec0b723268e9480fc0ca0

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          36d98122898f1cf429658fe78e59610f

          SHA1

          e69938a86db8846545b3b606cfdc663dfe147ce9

          SHA256

          ccac4ac5fa0c32297c40e73a6d6fe4d72467b2236b98b413f4f5624b4ea990c6

          SHA512

          11a4f66a42890eff61bd2d80cd5e9016b2375481d28e4bfdc3d928167dc5d3f133c2fe0505ec3e0a927c33a326207926a594fc8f5574f1c2cca58e2d8b0d43c7

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          99eadc93f96f25439810b1db169f59e7

          SHA1

          f84cb581593ef59e0550e536e26a3cb28f43a680

          SHA256

          ca6a42c1b76318d800dc3ae14389d57fee7d4cdcc229ab0dd24b560e9b0c0732

          SHA512

          5b9ccfd6a3a69a19f97e3afa61ed0edaf3ab5d9602a656de79dcab7e86c94e3754ee73a03daae4a96857b4b5b5b2b8e279773cc4f73d749c8ea027c9ce0d8f0c

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          8b2805579759dac8d17182d8756531bf

          SHA1

          7932467fde0ff6db3d63041576c0ecfe0f0e8288

          SHA256

          80866f8d3c167886d0b6eee2643bb8ef2e5d0611f3433b563a40d8d3988ad4e2

          SHA512

          a99dd4618f39a2db774e7c5b7bed681e4e4e5dc2b42d8f95bbc93949fe05bbcd4c6f7a13fa3d4389dd3d776b6884da0f19799ebf62a788bb3074fb1e99cc0f6f

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          7e1bfd5380867a01eeb4db171f951408

          SHA1

          1b495acfb4e2444f01b9350fd4d61d5ec7b0b522

          SHA256

          92a0d0f7f79d62d7e08edaf2a481ca39b91337ee563d18af819f367edbbe719c

          SHA512

          e0a2aadba2892d5f9fff064164193fa742f8a645f61088579ef95036e8fb60d3d3c9fe9edbee24c20d3386672bb6d3e9c4f095c826fd6bbf7bc3a8bade9bd88e

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          c526883e07f3023e2ef1eb9c8f4d07a9

          SHA1

          043bb78d511b5a501491f7c6af249f0f14498ce3

          SHA256

          e69e5c8ca2b99f504b2cf2b96ba801ec6297b04a9f30d9c4af1a1c6d97bca1de

          SHA512

          48198e28ac089ceacb8728bf9a6136becdd297e53bd1418c275cdda6f5dc177942ef8036b0141fb1c0be4a13dbb82690064c68caf4631fefb7e5eb726eb41455

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          2KB

          MD5

          2021477389a8427c4ba69a9b2e22b51b

          SHA1

          3bc7b494051c143f0de871c267b5de1fa689e9cf

          SHA256

          c6e615036cfbad6512747d3c3614da1f7e8cea944c0d09317528ffa0f51c17ec

          SHA512

          020f91fdc11ecc5e4ffbbd0a134dd1f48ed6fa33c2d239d9cfea85128162f8c990a06d55cdb44346685f6d0769884bbe0d617a45fb456105c6e7700f304e9517

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          3KB

          MD5

          57c856b8128555f85e6341f430edf065

          SHA1

          e86d2e11c5dc7653f996865631de0f903a897613

          SHA256

          cf78b4923a12e6c56e394a63afe5b49529210d819a30ff43caee0662a83a63ab

          SHA512

          0ee8e2ffb975c893df610885dff703ebb253b29e341a002c684d3478e0a6c4163a5b74c075d0df96b4fb81e8f871b416351facc5a5a9e118f367a8ac405e1761

        • C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG

          Filesize

          4KB

          MD5

          734f736504531047064ef5505dee8cdf

          SHA1

          3536ea438db5a262901488ad1168fdcdbb760a0f

          SHA256

          d0201d233c2a2c2de1bcd95f2d122c8a6e37ce8a73543c81f3d1932060bc723e

          SHA512

          f4a15f5c448c413c7e2dfe75016456cf1be9e993afede97be6a348b72ac35a8fff4a2519e08c8e89b02a1e05b2a25593a820ca4a1bd0dc60535a377970c3d71e

        • \Windows\SysWOW64\install\updatet.exe

          Filesize

          30KB

          MD5

          0bd6e68f3ea0dd62cd86283d86895381

          SHA1

          e207de5c580279ad40c89bf6f2c2d47c77efd626

          SHA256

          a18b0a31c87475be5d4dc8ab693224e24ae79f2845d788a657555cb30c59078b

          SHA512

          26504d31027ceac1c6b1e3f945e447c7beb83ff9b8db29d23e1d2321fc96419686773009da95ef6cd35245788f81e546f50f829d71c39e07e07e1fecbf2d8fd4

        • memory/1244-35-0x0000000002510000-0x0000000002511000-memory.dmp

          Filesize

          4KB

        • memory/2028-2-0x0000000074EE0000-0x000000007548B000-memory.dmp

          Filesize

          5.7MB

        • memory/2028-30-0x0000000074EE0000-0x000000007548B000-memory.dmp

          Filesize

          5.7MB

        • memory/2028-0-0x0000000074EE1000-0x0000000074EE2000-memory.dmp

          Filesize

          4KB

        • memory/2028-1-0x0000000074EE0000-0x000000007548B000-memory.dmp

          Filesize

          5.7MB

        • memory/2036-29-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-24-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-5-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-31-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-28-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2036-841-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-3-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-34-0x0000000010410000-0x0000000010475000-memory.dmp

          Filesize

          404KB

        • memory/2036-10-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-14-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-18-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-7-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2036-21-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB