Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 18:26

General

  • Target

    fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe

  • Size

    851KB

  • MD5

    fce3e2274c2d06fe2e10e5f5c492d93d

  • SHA1

    7acfd8f04490fcc524d3db32026718bf3f15f663

  • SHA256

    6f68e9504b620b6f04078e1e696a429d2757647f35101276af3de93f9042fe81

  • SHA512

    304943e12f29cc05fa97718f50ed01eca4e99ff6d46531b1e1fbedf272d655c3e5520c1acc649d7008ff59f04ddb85abd015160e667367c7d8394c6d71c469a1

  • SSDEEP

    12288:BMoVefu+XY93VM/6sSISPehPEYDxGhhkZEZivnNxaT0Iw5pkd3DUe/:BMPfuZMSsNN9GTmEsnlc5DUe/

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1104
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1212
          • C:\Users\Admin\AppData\Local\Temp\fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Loads dropped DLL
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1848
            • C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe
              "C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2940
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dabat.tk/
                4⤵
                • Modifies Internet Explorer settings
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1944
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:2
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Suspicious use of SetWindowsHookEx
                  PID:1052
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:856

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            87271e1b6fa630cf6c4b3e38282c752f

            SHA1

            d1a3b31b8e81db16ac7ce5d41b0a2f1a7d2e1f7c

            SHA256

            8ca60a041630ac2635b609cebcda7f1dc2c62c7b321009377d4edda3c973c350

            SHA512

            0c6bdcb7b1e125aa0abda567f99b72cb687c36d880bc1a572193322985a33895b9ab8a8dc767db0bc407524a45f5618eca5c4e7f9de245a71a5e53e1336acd36

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c1375f288baea10c13b77eb291768ed3

            SHA1

            ac4d5b8b231f5967dec5dceb04fed4f6ba85a187

            SHA256

            b485ef0c7417e95a24d2b2d5ac3a4ecf11faedc9a136d0f8e39c9979dcb061ad

            SHA512

            2db2905d208640af041df935c236c0ab43789579903659770d22f37aec92f066c35cb1ddfa17645881041276f4fc59c1403900aee0887e3f553035edfebfddb3

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            89e6c605ead5493ae51d9a2ccc94de30

            SHA1

            5c1b11360cfef1576832d2b4e03761a07a2d93c7

            SHA256

            3c3b59de0552575cf25fd33fb0a2c73be1974b3d5c2e8c65f189bee68bcab84c

            SHA512

            d257fdda8555141615d702bca63bdc593c90c47007230dada42b018109e3d9b136629d88d8c533aa51894b6b9103cc29ae3b327f99d2610eac45f57bf98a59d0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1a911c115744d6469197b6ad4f902a8d

            SHA1

            96083bc05be9e7599b415fb83cf74520e51079db

            SHA256

            2197673994bb7be89247ab3e254928997aa8eba9d437641c02bf655cb08a7502

            SHA512

            4b0e2c99667623af1f4e7950d11d840d3db55cde919f84f35e8bf8ad769f92e4d3a9fcb2e4f8875307675b8b7747b6275691cc97d76a562752585f823e05eef5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0aab384c6fd34689900b702b9643d2d1

            SHA1

            15432c22fe61d5dfff6c9985ecaa7b9183263176

            SHA256

            bb9f57811760e38fe95503d96133e00f568b7a609081b54536c322f7a51a1483

            SHA512

            f43972d6ff689c96c0e72edfd9696ed5bbc03c3fbd572c8782ba2df69dbc8fe9a8f02c9fcc909f76d89e160b5ed2146ad80c59ceab04c4fadd6fda2b6c6dc071

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            18beb9974e491385e632d8f3f746e7aa

            SHA1

            a807e8f30ab2d4f01aaadcc72e4e0de3dd06a1f2

            SHA256

            126f50a7a34cc0c4885476ced140949547856c28ae6431f1cca40af980233d9b

            SHA512

            83c2903031faa1235a3d70133ff064f24bdb5c71cb4471b87a0f72659260e1239dd698f83d6d2dbd9ab5810cc3d644065c563b833f20f192c4aa7d39869fb98a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f68dba0d6f05b035b72a7f95dcdb09c1

            SHA1

            e015ab200aacf11e79fcff9fb0e93ad557a1158b

            SHA256

            7d7ccfef6c138a2078fdd2d9685f5ac7e480fd7e7c8835256b8df9eb42497863

            SHA512

            203e0e94f0c0f6bac909020e44ed04edbbea5af9d23f918f1ffe1bbc082ce1fe3986d943abf93c2b23014e8fc63c06faf81df03415e33669c327e006ea14089b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            07390eb961df78ad9bc4847f3d6d2acf

            SHA1

            57a8f61cb27cc7f9b44e4081f73a1bd3d141eced

            SHA256

            f233d40a5395db655a93eb842c49c04583f0ca3cae88b67f57062ad857b747c1

            SHA512

            eeb3739b67de2f0a36d77385a073813b7297ce09e9dbf5665b21c99be0b9896dfb8697cdac1855ee6cdba85a9df9b44b919efd4b54b4ef2f2f5e4d5ee13ce698

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3ff13ee575a9780f1c495e10fb83bc3a

            SHA1

            8f9abe0386c79566cdd0c1ce6d475921ae1c7ba6

            SHA256

            76ac807d8b406423cef61588048b7f1da5654b7f97a41003e0b27abe1558cba3

            SHA512

            f1a6d758dab55696f5ea9e4abf5db8bab5c1de78005be83c18f6bc4808b9fbb59f30d71628e87f8edcf8d711299cfccaf4a305b565c4cbe4e2d41596a3878359

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            aee758ff713050acfa5ae41196ee338f

            SHA1

            b16cbcdc4634ce064c873ac427fa7de98a4c65df

            SHA256

            44cd49b3f8019594c14adf85bb7d5d1285f2f996a96edb2c2826b34261e48137

            SHA512

            e21154bce59eaf40ca5c92cf9f6e0583a43048a717d2a2acef1314448eebf19519e9f4032a7549a81f43f17da55c25492ef3046aa880ddf017e17f19ac62f82f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b8234d25cdaf258ce1ac984a94b92413

            SHA1

            e6eb0a1c1e852ce16ae93ef7099d00cc52c2c672

            SHA256

            e060eac390ee7ab4caedd76da0db9960c901bfef55ce228eceead079bb8174cb

            SHA512

            6907ee6b93dd462dfd32ad884e1c951e5624c98a02e3bafaa6c13d6fcf005e9a509187de837cfcf4d2f6d78e884974100863646510770a2c86d80e8ea76d7ea6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b9eaa54885e9b1fd34e6f94bec12d84d

            SHA1

            94dcf4b97576f490ed44192ac014ce98d0516c59

            SHA256

            84573cabd7712607e6df5bd14b00be3b7846175cadcbe601009c0332203c9708

            SHA512

            f2ce0ce98ac0279208757b1d2adfc0d37aba0d6695d64d4eb8b050fd5a34e7f99ca5893b1424a28d5ae5b80ba0f385fb9c03a20b673f7a1e72320e8d698d5a3e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            65e4c4286ab6f745b19e43c772b01d2f

            SHA1

            929014f9085977c5c42866600d901d0353663ca5

            SHA256

            a69285e4918fc0a7cda2ca6d32236c744dc149e5b32d3628cb94f67bd99f5cf1

            SHA512

            7d1f00d1e09a9def4994541fd6064b4aa648fd6253c2ab7d3514b10206cb3482ff10d050571bbf317308d21b7a99eb6087ef12357536823601f610359f2ba22e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c0c0014f1600fd307e3492f22352f478

            SHA1

            267904fbc0218951e39a66188c033bf56032d619

            SHA256

            55ce0b56b1e75663cd7a9567d3e59a8062abe9fa04352e47c5e4b2b15e73b329

            SHA512

            f8a27564be70ff4cdfe5fa49328197f78fdec27308d0a6db5785887146ae1444f057275fe406d890d3041b6c729233e2b6b608fd58a8e9f1370b57221b63fdec

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ff13fa1c7e2bf8afa85d36a463b0822b

            SHA1

            89082bdd06f4b7c556ace9339546c8b0c3169823

            SHA256

            e7b2840c45e5887508c8530e4a3f641451543570729858bb49303829cd1862a3

            SHA512

            fc484b3fb6d530efa9a347061ba57550f17e1dddd5b03fffd06ef0c652009fda71388961fe9c4bcf35c8e9f81131a3943e066273b8748a5d32c581ad001d2d09

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f9b896598d0ef0e1301650be2295865b

            SHA1

            ffacaa46a3427d61639af367c98f41d10dc68d3e

            SHA256

            07d740c8e59abeacfdf5621243713f8995ef02c8d40581b44b63bf4d5a4bb6cb

            SHA512

            19de42265c5faf59f9b61739ca0304053a76e645e13305bcc5221c16ba05641baeca8522b56a4bb1e9174789074fd1f9e900cd7fbb1620c1431427157a009f0e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cfad7ee460890252e17ab869182e939d

            SHA1

            b3b0648da7efb9eec80f7105876129f57d39eb7b

            SHA256

            a86eb10d471f9005b963796441ba830b1ac3fb3862eda1acb862810025de9818

            SHA512

            263d6ef648942215771978313be2de976fd562b077f4b51f9bf8c3530d539e090db4fa886d6f7d34b35f467ab94e43632603336e6e7101dc2814826c9f9f0e0c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ebdd3568f78562b239052d5041480f14

            SHA1

            8270b3b0d402434ddec737a628532b5866ad2b0b

            SHA256

            646d9e22f4023b0d40ca14ee11d55e0236d49f92e5f784aa3444d9ad0aae9491

            SHA512

            2d0e2b6df506ae0d06e458c789ad2ee3751171d7df8079c4dfadb8a54d6497d40bb08ce9ecbbc9bd64b60dc73f7a9998410b777613c90d0bfa3364805f811713

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ce79bfb1cae203b57258c80f5d2005ea

            SHA1

            5afcd59de5562fedb6cc10010eb31b7fa53b01ac

            SHA256

            8bebf23e354fd0f5d76b7631d799e86c52769d6b62aea4c96901132183335551

            SHA512

            7f88e90cadbbee16b1621644781d710e661bd05b5a70bc4a76b063383cd8b73d8ca1d47ea35c8cb59053dc70057b0355de7707318a39d63aec26e04705a7fd98

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            dfd0eccb5a4f67ed7a4fe159e04ef5e7

            SHA1

            b1c2edfd1d73fa0799b81dfe39a26232a1e7dec6

            SHA256

            3a335a8e1341e2ca45729f917f0ce557f86af9ad625842be6ccc67d779c4452b

            SHA512

            1fc7d4e69e4e61c1700c4aff5e206caecd1281dca40a5c3d72569d8bf9a45652cccd9cf9d590e6329436476320ff49de0c6212dfbbd4011ecdaeec148ffe66db

          • C:\Users\Admin\AppData\Local\Temp\CabF28C.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarF36A.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe

            Filesize

            260KB

            MD5

            99daec22ea48c348ee431c334d69feae

            SHA1

            95174432ddc9576a21dc3281a23926b67c4abb91

            SHA256

            bcf12f89c864b93a826ef9ef96a2cc238f105f1e3c45e0d24eee16af47f83219

            SHA512

            2ec5eaacaa25cd8d00c9b0f5dfbe332b4afa4c283bc1f9d9e8f282c6979776ae5d58a086ffa720e52d14ee787ec301e8fd3a3b7f24e808dc0f11f09ad12b346e

          • C:\flvb.exe

            Filesize

            97KB

            MD5

            31a14c6c6e300a3209302bcad0b98a43

            SHA1

            24a29caaf20835e67d80aa4c64a4d8ca12d2ce0a

            SHA256

            ce85b7566c0babb68fe649bcd704a70d2352ca8226b67b214dce257fdcc37a34

            SHA512

            f976d142340710760ae0a6b99592b2e312b3a13414ab3feec9be95c7dc6085d64b52bf0165133b8346dc87a422fda411fa8fd09b0506157b428ec1ed861ce2a4

          • \Users\Admin\AppData\Local\Temp\~sfx0026D167E0\GIFviewer.ocx

            Filesize

            100KB

            MD5

            73404435b36b8cb9ea68be6d4249488e

            SHA1

            ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02

            SHA256

            2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c

            SHA512

            e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7

          • memory/1104-32-0x0000000001DA0000-0x0000000001DA2000-memory.dmp

            Filesize

            8KB

          • memory/1848-54-0x00000000030D0000-0x00000000030D1000-memory.dmp

            Filesize

            4KB

          • memory/1848-536-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-70-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-72-0x0000000000400000-0x0000000000525000-memory.dmp

            Filesize

            1.1MB

          • memory/1848-73-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-74-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-75-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-81-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-82-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-1-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-84-0x00000000002E0000-0x00000000002E2000-memory.dmp

            Filesize

            8KB

          • memory/1848-87-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-15-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-30-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-29-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-19-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-103-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-102-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-106-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-107-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-68-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-28-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-65-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-176-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-40-0x00000000002E0000-0x00000000002E2000-memory.dmp

            Filesize

            8KB

          • memory/1848-64-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-177-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-26-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-61-0x00000000002E0000-0x00000000002E2000-memory.dmp

            Filesize

            8KB

          • memory/1848-62-0x00000000030D0000-0x00000000030D1000-memory.dmp

            Filesize

            4KB

          • memory/1848-317-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-0-0x0000000000400000-0x0000000000525000-memory.dmp

            Filesize

            1.1MB

          • memory/1848-57-0x00000000002E0000-0x00000000002E2000-memory.dmp

            Filesize

            8KB

          • memory/1848-14-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-17-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-435-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-16-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/1848-69-0x0000000001E90000-0x0000000002F4A000-memory.dmp

            Filesize

            16.7MB

          • memory/2940-553-0x0000000003B90000-0x0000000003B92000-memory.dmp

            Filesize

            8KB

          • memory/2940-48-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/2940-63-0x0000000003B40000-0x0000000003B41000-memory.dmp

            Filesize

            4KB

          • memory/2940-60-0x0000000000770000-0x0000000000771000-memory.dmp

            Filesize

            4KB

          • memory/2940-66-0x0000000002920000-0x0000000002921000-memory.dmp

            Filesize

            4KB

          • memory/2940-67-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/2940-99-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            Filesize

            4KB

          • memory/2940-100-0x0000000003B90000-0x0000000003B92000-memory.dmp

            Filesize

            8KB

          • memory/2940-101-0x0000000003B90000-0x0000000003B92000-memory.dmp

            Filesize

            8KB

          • memory/2940-90-0x0000000002920000-0x0000000002921000-memory.dmp

            Filesize

            4KB

          • memory/2940-85-0x0000000003B40000-0x0000000003B41000-memory.dmp

            Filesize

            4KB