Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 03:45

General

  • Target

    88dea4b3191736270f9057dee7f8e7b0_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    88dea4b3191736270f9057dee7f8e7b0

  • SHA1

    4544dedbd265e62c88958d5f8fd9e61e0dff9ee6

  • SHA256

    194c4c8e422b39853379ce0de407713320da2bdcbf40be3203fea3520e3f3a14

  • SHA512

    bfca91a51c0a73fa77acde31935339065b64ae715f9670979da0d38974078de905ad2d43342c331452dbdb3739c4d24c68805ae18aec803e83bda1e5677cfe64

  • SSDEEP

    24576:CzCtx5NqOtj35jCPLw1lgGQwC3lulTiyFv4ZWC7+Ep8rNTfmvNvCX:CE5N3JjC2lCTluh3XCKa8rNCvwX

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 11 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1160
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1204
          • C:\Users\Admin\AppData\Local\Temp\88dea4b3191736270f9057dee7f8e7b0_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\88dea4b3191736270f9057dee7f8e7b0_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Users\Admin\AppData\Local\Temp\file binder.exe
              "C:\Users\Admin\AppData\Local\Temp\file binder.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1664
              • C:\Users\Admin\AppData\Local\Temp\File Binde.exe
                "C:\Users\Admin\AppData\Local\Temp\File Binde.exe"
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Deletes itself
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2488
              • C:\Users\Admin\AppData\Local\Temp\FileJoiner.exe
                "C:\Users\Admin\AppData\Local\Temp\FileJoiner.exe"
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:348
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:2040
          • C:\Windows\SysWOW64\DllHost.exe
            C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
            1⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:2476

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\529078_2018460956765_1701139408_992190_74901341_n.jpg

            Filesize

            11KB

            MD5

            0c4335222628eb8e8330cc9f4dfcb27c

            SHA1

            369b6eda556e4d026503608e6c79a5504990d574

            SHA256

            7e189625b76f61b46b192f9c450dde09b9fdd2f7d12bf26118314d252fb4e932

            SHA512

            e4ef6562bdeca6a4d7727a860708bc95a1cce56a1ff53e97d326c8c75a18b58f22e0f1e4e5b8e31a5947a59478b14526f8a994d339b06d934f680f15077a3c74

          • C:\Users\Admin\AppData\Local\Temp\ic#0

            Filesize

            3KB

            MD5

            10f593c565d903d77d2c2f3937d871bc

            SHA1

            792dcecc1df125fe3fb306153fe55eb0ed1fcde8

            SHA256

            1aa66378f94786ab1fb09e49678d68e4db0f627f88987645a100bd1278a5646e

            SHA512

            0d9588a3dc6e946fb0f72a63d1efa73e72d8536d24cd00b93b87ce939c82883ec70e11dd65942be268af0334464aee0fb6db4d9b2ae43d3011c6de659bafe518

          • C:\Users\Admin\AppData\Local\Temp\ic#1

            Filesize

            3KB

            MD5

            e6ef70517d846723327491c49ac40a53

            SHA1

            72e559d9da02c6cc77da0f0b0242cd874dbff38b

            SHA256

            a2d87c0f15b38351059846f376a8083b7df89b2ad82ca495c919a7626a117c3d

            SHA512

            25f0db16b910c8b2b780fcd3182de8c140b2bf90b18da49999d9e64e3e69ba3d73a02b8dc17014c8981d7cbd95ef38a9f578ea54339f05f44b7aa47c82a79fc9

          • C:\Users\Admin\AppData\Local\Temp\ic#10

            Filesize

            3KB

            MD5

            2e36c1b78bc3f83b6e95f59f1282a075

            SHA1

            927c840a214d0a5143c07c20f093233ac761dc3e

            SHA256

            5f30ddcde1ab8e11a13b1fad1c3ea02d9049dfbc76facaa400b8785b0cd1364f

            SHA512

            06aa72d38e0f75d50cdf27a7123fdd0479dcfb8a91d4afb0789527b72580a2f8b9817ad380849d1fd2cf2ae960564c958ee340d8e4719be6465fea552fffeaa3

          • C:\Users\Admin\AppData\Local\Temp\ic#11

            Filesize

            3KB

            MD5

            4979252354ca1b2d5c5e44c0e5485a6c

            SHA1

            31c5e39044a5be2b7e5c441cc9621b95eb90f679

            SHA256

            1491b2624b425f190c1cac65ba369f01d4dc105fa2319918c22567101fe3f9a7

            SHA512

            cc4535d3f93f2bd8dc2ab863f5bd9306357f40407d082d1adad7f5304e80c3ea4f1011bdc8041c2c0485859e4f596d2e2d487ecae7d40df9da17baebabfc720c

          • C:\Users\Admin\AppData\Local\Temp\ic#12

            Filesize

            3KB

            MD5

            bc4a99c867092521255e7f5feaf64ac4

            SHA1

            baf9c05ff667cee9d38d352d21bc2fa2c005dfc3

            SHA256

            5c0b91194e47e3d027d9f82fcc78da53a52b7c3ef4db202600291ba2d5c73a40

            SHA512

            726f6354f79065ebb36ab1ddb8cb8144a22ac8defabad5feb54b5ba18ba977fd9f705133341cdcaf1c0afbf90192391b6e3ebe15fab466e36120feef02ddce7e

          • C:\Users\Admin\AppData\Local\Temp\ic#13

            Filesize

            3KB

            MD5

            5c949e1fb6892bc52b6126308b7a69ae

            SHA1

            2e662e3bc392d887372a7c8d38805632ad28028d

            SHA256

            179fc477de56b62e6da89a0266768c8b49ddb7b4be56f1070b4b32ad21b4b263

            SHA512

            b57d0572e0a53790524212ca7da58a83d8c14d7d5df7bcf840270fe30134a442d7945890bf257d7b5d46ff3725201d548eb957a2865e0f0a608d48bc6aa8d8a3

          • C:\Users\Admin\AppData\Local\Temp\ic#14

            Filesize

            3KB

            MD5

            0c166eb92417af53e9df390c2a30a6cb

            SHA1

            45c4349d3bd2edc42c5d95b0fd5793377beb3858

            SHA256

            121f4ffad2f323e907cd5c7355c4a29e9f1b50bffe420a6b228f62a50503826f

            SHA512

            f5e89ce070c595c1acf32fb8818c9d59cbeed615370cfc5b4b86a257909d031e7d7dfca962b831a31c37325b6c3626e43528a4fac3690e4e05ebd23b84d73b84

          • C:\Users\Admin\AppData\Local\Temp\ic#15

            Filesize

            3KB

            MD5

            5cd6da6e05901e3d30914f3fc6d6c790

            SHA1

            a054ad7e7c0efb5b6c17cef6a1f0c0ffe151c9bd

            SHA256

            effd0482c7ce5beb4e5620e9e5fe96f09b4412294b4e85c638e9a4d26545b024

            SHA512

            16f9256e3b99ebcc0d941685b904143830a3d0f8b1883d26d260863577bbe080925c4c171ee5ac6d37e87c97b0b9db5ddbc57c0598898881a12e82c90a5d1e80

          • C:\Users\Admin\AppData\Local\Temp\ic#16

            Filesize

            3KB

            MD5

            e768f678a8453882ccdfd44ce6deb9fe

            SHA1

            b7b99029fee6962b4c475d746009ea8f516234a5

            SHA256

            a80de28205b3b15beedbdf86923ab009b2a7761a5d8b96fdde240b10299ea29d

            SHA512

            089a66ee5104ff89d480d35dc5c9e7d13a5442d408586d4fe928e95a89b16222b1db5c9e43ac7198ed8ca3ec0aa65a1c31c6b973ba3fdf8364e7c2d9a6a0cc81

          • C:\Users\Admin\AppData\Local\Temp\ic#17

            Filesize

            3KB

            MD5

            120237b6f8a17e1990f1e731741c4044

            SHA1

            89347688431f58bd35d50ac4e9ba836a31fa6aba

            SHA256

            ae24ccf28ae397519bee9452110719e360249660c21df3d53279499ade89f198

            SHA512

            f6d72c1a5cef72da958feaf102bbe2d78c4f142433a5f64aecd95778aeba48659435ee7c3bc7b32b0cd30dff6d6ce60393f0b6dca75c8e424bc848d030840bac

          • C:\Users\Admin\AppData\Local\Temp\ic#18

            Filesize

            3KB

            MD5

            e7a6f968626084a7c5a72aedbf5bd315

            SHA1

            007891ea6a4b64d851f167f9e6a2afef1ed5a52c

            SHA256

            39d6b865ef7bfb315d5b96e1f6ee6e12dc612f8b0aefa4392e17e0192ffe8de7

            SHA512

            5e9af9b112a183be4b9976533a0f900b46614e804ee292868dc2d83d9d17cec82dba195dd0a785509c72a73c0d2137975d11db7d716de6b3cd07188b46870d9e

          • C:\Users\Admin\AppData\Local\Temp\ic#19

            Filesize

            3KB

            MD5

            a4064df61dc9b9485213b2947f79e662

            SHA1

            8499bbba69d6ad960ddc1ad58b2d68cd2904e207

            SHA256

            2ecb83a57e5898aa275b4ad07d06ab5f6844c3bf424b01702000ad6dc9ad9736

            SHA512

            fb70b56b21a1af3c6a3173701920d8e6e44fa69148ba18801c72f8d0e69e39bb3614b56dda03e7016b503837f5c7dcda0ea329dab57a15e20b9d77fb66f64eb0

          • C:\Users\Admin\AppData\Local\Temp\ic#2

            Filesize

            3KB

            MD5

            19243603f8bb07b2847e9dfc095fdfca

            SHA1

            c4e33d7d767f284ff82ed8dd72b957cd7e8db7b1

            SHA256

            fcb0a4bacf0895d183f088383cb55ae297a7ceb61a97b1d08d494bfd6ea572e5

            SHA512

            41dd1b2c512d3a5fee1d735345bdddc2a4c4e036f73d396d8394071e4b3982532c52a870ba5a4920cb4fdafdc88218f12e5b1893becda0ff73035992b60877d7

          • C:\Users\Admin\AppData\Local\Temp\ic#20

            Filesize

            3KB

            MD5

            063275ac89c44dcd99242e7be6846930

            SHA1

            c1e47fa8b70326f9a228843b2fcb23447657d5db

            SHA256

            387dcedc1bfaab5822c4b111a75e2997b51667ca09d29d591732f5a27bff661e

            SHA512

            395f3b682f3609744bd7c86e685dfd761750f6679de04911520a318c5ec7090b57e8ed965b0b1778e9d52b7f506bc22a62598c726fd913789252edd5f97f59ce

          • C:\Users\Admin\AppData\Local\Temp\ic#21

            Filesize

            3KB

            MD5

            15e9fb689e49a973e13382fe5a3e1622

            SHA1

            a83227a3c6f2659bc17a39f86968f57582268407

            SHA256

            d94747ec3fbeaa6ab494e3250b17de741d95a1dbeba9c713b297e75a992f3085

            SHA512

            28bbd2c4834c5006e19a5d03a6803fcef6986e7b46cd487a8a6b9ab0cde2c7848391749deb00242a6025d6d8ac073462272d60b1cd3544bc56fe798a79b1c982

          • C:\Users\Admin\AppData\Local\Temp\ic#22

            Filesize

            3KB

            MD5

            88b4d7849de2b7a9afa656f98684be82

            SHA1

            0547c87737f471370b4ed5d0447ed3481d244685

            SHA256

            26123f378441ec10b634d83bce84f6c31a91923606ab058a5dfb08e0ad82a293

            SHA512

            af1f3d13f15655f033cf42281c83c7508ab583d01a8eeea818cb775a447ceb3fc7a1c719229b854b1e2955b72a2b24a4f2872d41cad1aaab0e5ac6af8b3b01e0

          • C:\Users\Admin\AppData\Local\Temp\ic#3

            Filesize

            3KB

            MD5

            1139f9d1ec6cc1e2b4821e265c7f2b0a

            SHA1

            4088e2933e2371e262a9df5bf611fddb1a438a9f

            SHA256

            eb3ae04a48c0a3173975a3b877924dc9115569ed353a65d0c85818aa3140f2c2

            SHA512

            fd05fcce50ea548e99ff1f1956fba90d1fe31ff08c215d18bd36ed5238ab9b9aca9bce558e60c1a71d6d97d0e5adf790750343b95976477560aad4e625452aba

          • C:\Users\Admin\AppData\Local\Temp\ic#4

            Filesize

            3KB

            MD5

            40913e5fab8c231d87ae9ed82ddc48a6

            SHA1

            2717d8b0833a13b2e8902da04437518c5092e1a9

            SHA256

            c99cecff6b1543819ba333c12918a2ac99023ccc0c5b29b75c82e8d92d72b679

            SHA512

            8ce3e46bfe00e16da243679334de20fc3c11e496cd40caf44e85af9866dfe070b1bfad1f16cdffb693ef46302e3c270556db7420416ad156062a0f5a6e0f8ba8

          • C:\Users\Admin\AppData\Local\Temp\ic#5

            Filesize

            3KB

            MD5

            23de7235b4676c9c53c5cad7267abd62

            SHA1

            7c7eac55d44f13852222097f20a92bc1851027c9

            SHA256

            468a650a28af530f1283f0ed9713baaa2b8305df07c4b61de1b387eacc303e4a

            SHA512

            22af58af70392f7b629d69270db842eca71d4f094e9fe3d039ba3abf05f3225645d3eb8c762edd373be20eeec0bdd40fd34239f4d89442fe4ac9e1fa0ff8ca8d

          • C:\Users\Admin\AppData\Local\Temp\ic#6

            Filesize

            3KB

            MD5

            1d8a70dff325f5dab7305db3e3fec39b

            SHA1

            218a21620d789da24d4ef26e1682a85f8b93467d

            SHA256

            05d69813b6188f8ca3234aee0844c2ae8292030877123d4eb400765f05906063

            SHA512

            24d0af7eb954c2e549e0f0cf5b4e71dcd1279367f44f33fa3bc850db755ea1bc178be65f9ef17e6ca36295c1eed4ec7c2bc56aa58dedd9f4c5c28b3ad122bb4a

          • C:\Users\Admin\AppData\Local\Temp\ic#7

            Filesize

            3KB

            MD5

            fe99c4fd792f89afe753aca126c44c9e

            SHA1

            e84703397d01c2bb811cc016aa37881bf9003838

            SHA256

            cf37071e2b083931abaf1034f7cfb5750039e212c06d5263720820f1fdced698

            SHA512

            e3d058e529f65e7cab56587c9b0a8a8fb80fcb53cbbeb86ef70c4c8b6fc06d62afcd18e1473f67e275d45786e6bf0b5aa9fd4827d9b5764ce092bf4959ac973f

          • C:\Users\Admin\AppData\Local\Temp\ic#8

            Filesize

            3KB

            MD5

            9f7723220e334b22df66e70bd110f238

            SHA1

            f7e89ebe46d67c6ac2f2a93efd698b189a2d11d5

            SHA256

            4da8695f82e607f1d9af8444d37d08df970efa6cb9e910926b8060cecdbca11e

            SHA512

            339cfa1f1f31cefb6a68f24e0be6a25af5ad696708cc1bc99ae4f8514a3a3c7b67bb1aaebfc65418e2d1ac8e670c8ff225d91e94d02f2d8f7cb40a17e774d6bb

          • C:\Users\Admin\AppData\Local\Temp\ic#9

            Filesize

            3KB

            MD5

            db0efda90892b46443dc7fbcced6d195

            SHA1

            89b61a9b1a6901e64c150d8db1a801194e121a49

            SHA256

            78fbf29a8009950a388869b696fea6bf6f197d52a0bb23736eaae53fa14b2b1a

            SHA512

            1ddcdd83051d0caa0a34c57c76f4491c444c7f75488c9820c1c63b03c0d0c3eb02d1730605ab24275f768ad108b2ec4075a3a44306351632c322c0aab4f203a0

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            6884bf1a9de2760b5c45388b16e51d07

            SHA1

            629439b2051d260d6f6371e7a9e6aac1e1904fc7

            SHA256

            f2390979e77a828a609d4d9181c518bb28ebb5ad62bf9b5d4adf4f4a17706fb1

            SHA512

            8945bead8494d01c1fb268a5a96bfd3a4ce159140e9621db3114e21d75447ef1c259f3b67353bc0731ed66db08f2ee96525a567cab04db4eebce7765232593e6

          • C:\htckd.pif

            Filesize

            100KB

            MD5

            7463013ab13ae48ad8277745749c6dc2

            SHA1

            0507ae846337e99cd72debde10b386b5d682e251

            SHA256

            79694d53f16f9269cd777be46e9f3257c2afd75619f25d1b04260d9a20694eef

            SHA512

            dac8287a407b74845d9dfa5dfc6337577ca1525959f479b1fc4022f4f85d44bedf39c5efed9802496a185e47e383c1d7e8a773fe2970633966a2d165492c3326

          • \Users\Admin\AppData\Local\Temp\File Binde.exe

            Filesize

            298KB

            MD5

            32d687da2eb634d1c6a56c8e595bee83

            SHA1

            fd700d996a704415931a4c3bdd2eb1baab4b1dc0

            SHA256

            5feb3a995c070dfa8a6668edbc76b6921abb8ccb2507634f8d68cdd111f0ff6a

            SHA512

            12986142e3b8082ff1c9d06a7e52d6232a02034fb8e0a6b0223af238551e01eaab480ba8168a63027190d233bb79d2844db99363f03e41f5f648e2d4d7fdcd25

          • \Users\Admin\AppData\Local\Temp\FileJoiner.exe

            Filesize

            752KB

            MD5

            0ab9151c47b0f6e8175978586cfcc4a0

            SHA1

            60a2e196d1008e3c7206340a5dd1c2e1b995b475

            SHA256

            0c751133da9edd7d97bc952f746bb1f90ad1e926885c9a0ef4dc4928da7f1698

            SHA512

            3fb1ced73acde0a7eb19beb7d675b9f82b1214b21d7185a010e87416298655dfe396600a3f927e78f2eb708cfbc512db57ce7690cff9557e79b7cd087cd4856c

          • \Users\Admin\AppData\Local\Temp\etlBF2A.tmp

            Filesize

            172KB

            MD5

            685f1cbd4af30a1d0c25f252d399a666

            SHA1

            6a1b978f5e6150b88c8634146f1406ed97d2f134

            SHA256

            0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

            SHA512

            6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

          • \Users\Admin\AppData\Local\Temp\file binder.exe

            Filesize

            1.2MB

            MD5

            077462b150aaa177c2944c59dbff5a15

            SHA1

            f90095ed49bfd5b32af8702aa2a1e74596fe2273

            SHA256

            2e6cf16d8321a8471299e76a23e0178570bc6dcccac4b71de21abb306e22dd9c

            SHA512

            4f70cbcffb1d82489bc5617aeb89cf94352aea52dd125bd7c8a2b6556388dc39e5625a71df28cae3b189bd1899f6b7ebc05bc030080ad085d3efc24d3ddc3cca

          • memory/348-59-0x0000000003AC0000-0x0000000003B33000-memory.dmp

            Filesize

            460KB

          • memory/348-335-0x0000000000400000-0x00000000006CD0DB-memory.dmp

            Filesize

            2.8MB

          • memory/348-94-0x0000000003C40000-0x0000000003C41000-memory.dmp

            Filesize

            4KB

          • memory/348-51-0x0000000000400000-0x00000000006CD0DB-memory.dmp

            Filesize

            2.8MB

          • memory/348-98-0x0000000003C30000-0x0000000003C32000-memory.dmp

            Filesize

            8KB

          • memory/348-46-0x0000000000400000-0x00000000006CD0DB-memory.dmp

            Filesize

            2.8MB

          • memory/1112-63-0x0000000000480000-0x0000000000482000-memory.dmp

            Filesize

            8KB

          • memory/1204-275-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

            Filesize

            28KB

          • memory/1664-30-0x0000000002BA0000-0x0000000002BBB000-memory.dmp

            Filesize

            108KB

          • memory/1664-43-0x0000000000400000-0x0000000000513000-memory.dmp

            Filesize

            1.1MB

          • memory/1664-42-0x0000000002FC0000-0x000000000328E000-memory.dmp

            Filesize

            2.8MB

          • memory/1664-31-0x0000000002BA0000-0x0000000002BBB000-memory.dmp

            Filesize

            108KB

          • memory/1664-44-0x0000000000220000-0x0000000000293000-memory.dmp

            Filesize

            460KB

          • memory/1664-14-0x0000000000400000-0x0000000000513000-memory.dmp

            Filesize

            1.1MB

          • memory/1664-17-0x0000000000220000-0x0000000000293000-memory.dmp

            Filesize

            460KB

          • memory/2476-82-0x00000000001A0000-0x00000000001A1000-memory.dmp

            Filesize

            4KB

          • memory/2476-265-0x00000000002A0000-0x00000000002A2000-memory.dmp

            Filesize

            8KB

          • memory/2476-102-0x00000000000A0000-0x00000000000A2000-memory.dmp

            Filesize

            8KB

          • memory/2476-263-0x0000000002520000-0x0000000002593000-memory.dmp

            Filesize

            460KB

          • memory/2480-76-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

            Filesize

            4KB

          • memory/2480-10-0x0000000002960000-0x0000000002A73000-memory.dmp

            Filesize

            1.1MB

          • memory/2480-267-0x00000000005B0000-0x00000000005B2000-memory.dmp

            Filesize

            8KB

          • memory/2480-9-0x0000000002960000-0x0000000002A73000-memory.dmp

            Filesize

            1.1MB

          • memory/2480-73-0x00000000005B0000-0x00000000005B2000-memory.dmp

            Filesize

            8KB

          • memory/2480-96-0x00000000005B0000-0x00000000005B2000-memory.dmp

            Filesize

            8KB

          • memory/2480-74-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

            Filesize

            4KB

          • memory/2480-269-0x0000000000400000-0x0000000000545000-memory.dmp

            Filesize

            1.3MB

          • memory/2480-264-0x00000000030C0000-0x00000000030C2000-memory.dmp

            Filesize

            8KB

          • memory/2488-272-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-271-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-88-0x00000000004F0000-0x00000000004F1000-memory.dmp

            Filesize

            4KB

          • memory/2488-61-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-32-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2488-97-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2488-56-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-100-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-270-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-62-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-99-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-273-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-274-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-55-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-101-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-304-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2488-303-0x0000000000220000-0x0000000000293000-memory.dmp

            Filesize

            460KB

          • memory/2488-54-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB

          • memory/2488-49-0x0000000000220000-0x0000000000293000-memory.dmp

            Filesize

            460KB

          • memory/2488-50-0x0000000002660000-0x00000000036EE000-memory.dmp

            Filesize

            16.6MB