Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 00:42

General

  • Target

    03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe

  • Size

    207KB

  • MD5

    03cae9ca903d0d948fd144ba9315a1a8

  • SHA1

    c3929908918990100f1930c36509b37219aa1b85

  • SHA256

    7b0deff51daba0c2967e71799ad43f2b7a53c36703051eb8e95bbe06df85c450

  • SHA512

    385691a678941ad3bd116cb80d79c7daf55c36a097ed019392fceb2e884de7178d1a1eb2e5631b45fb5d3689c3a8056914541eed810d211c69780cb46d02e424

  • SSDEEP

    3072:iNu9h3eiLZT2UTOyU2qTq/yecrqyEIlyny4iio1t1oBM9/AC99kLNh11GJ+UEtEj:lh3eeTXFUnq/yesLEoynn7BMJSXtt34

Malware Config

Signatures

  • Modifies security service 2 TTPs 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 11 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 22 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 33 IoCs
  • Runs .reg file with regedit 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\AcD.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2880
    • C:\Windows\SysWOW64\Tilecomgm.com
      C:\Windows\system32\Tilecomgm.com 480 "C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Windows\SysWOW64\Tilecomgm.com
        C:\Windows\system32\Tilecomgm.com 552 "C:\Windows\SysWOW64\Tilecomgm.com"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c c:\AcD.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:844
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:2540
        • C:\Windows\SysWOW64\Tilecomgm.com
          C:\Windows\system32\Tilecomgm.com 560 "C:\Windows\SysWOW64\Tilecomgm.com"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c c:\AcD.bat
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              6⤵
              • Modifies security service
              • System Location Discovery: System Language Discovery
              • Runs .reg file with regedit
              PID:2948
          • C:\Windows\SysWOW64\Tilecomgm.com
            C:\Windows\system32\Tilecomgm.com 564 "C:\Windows\SysWOW64\Tilecomgm.com"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1072
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c c:\AcD.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1272
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                7⤵
                • Modifies security service
                • System Location Discovery: System Language Discovery
                • Runs .reg file with regedit
                PID:2512
            • C:\Windows\SysWOW64\Tilecomgm.com
              C:\Windows\system32\Tilecomgm.com 568 "C:\Windows\SysWOW64\Tilecomgm.com"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1704
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\AcD.bat
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2092
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                  8⤵
                  • Modifies security service
                  • System Location Discovery: System Language Discovery
                  • Runs .reg file with regedit
                  PID:2844
              • C:\Windows\SysWOW64\Tilecomgm.com
                C:\Windows\system32\Tilecomgm.com 572 "C:\Windows\SysWOW64\Tilecomgm.com"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2672
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c c:\AcD.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1296
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                    9⤵
                    • Modifies security service
                    • System Location Discovery: System Language Discovery
                    • Runs .reg file with regedit
                    PID:1276
                • C:\Windows\SysWOW64\Tilecomgm.com
                  C:\Windows\system32\Tilecomgm.com 576 "C:\Windows\SysWOW64\Tilecomgm.com"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Writes to the Master Boot Record (MBR)
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2484
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c c:\AcD.bat
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1868
                    • C:\Windows\SysWOW64\regedit.exe
                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                      10⤵
                      • Modifies security service
                      • System Location Discovery: System Language Discovery
                      • Runs .reg file with regedit
                      PID:1008
                  • C:\Windows\SysWOW64\Tilecomgm.com
                    C:\Windows\system32\Tilecomgm.com 580 "C:\Windows\SysWOW64\Tilecomgm.com"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:2856
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c c:\AcD.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:2636
                      • C:\Windows\SysWOW64\regedit.exe
                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                        11⤵
                        • Modifies security service
                        • System Location Discovery: System Language Discovery
                        • Runs .reg file with regedit
                        PID:2736
                    • C:\Windows\SysWOW64\Tilecomgm.com
                      C:\Windows\system32\Tilecomgm.com 584 "C:\Windows\SysWOW64\Tilecomgm.com"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Writes to the Master Boot Record (MBR)
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:1316
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c c:\AcD.bat
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:2004
                        • C:\Windows\SysWOW64\regedit.exe
                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                          12⤵
                          • Modifies security service
                          • System Location Discovery: System Language Discovery
                          • Runs .reg file with regedit
                          PID:1756
                      • C:\Windows\SysWOW64\Tilecomgm.com
                        C:\Windows\system32\Tilecomgm.com 588 "C:\Windows\SysWOW64\Tilecomgm.com"
                        11⤵
                        • Executes dropped EXE
                        • Writes to the Master Boot Record (MBR)
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2520
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c c:\AcD.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:2540
                          • C:\Windows\SysWOW64\regedit.exe
                            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                            13⤵
                            • Modifies security service
                            • System Location Discovery: System Language Discovery
                            • Runs .reg file with regedit
                            PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\AcD.bat

    Filesize

    5KB

    MD5

    0019a0451cc6b9659762c3e274bc04fb

    SHA1

    5259e256cc0908f2846e532161b989f1295f479b

    SHA256

    ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

    SHA512

    314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    3KB

    MD5

    9e5db93bd3302c217b15561d8f1e299d

    SHA1

    95a5579b336d16213909beda75589fd0a2091f30

    SHA256

    f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

    SHA512

    b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    942B

    MD5

    4cee92ad10b11dbf325a40c64ff7d745

    SHA1

    b395313d0e979fede2261f8cc558fcebfefcae33

    SHA256

    eaeac48f16abac608c9bb5b8d0d363b2ca27708b262c1de41ab0f163c39a2fb1

    SHA512

    3f11992b0c8f7c6f0180f984392f86ea8eb1859be236e2bbfbc863226d3cac67b06700561f27fb673e2955c6ebc5b168dd28ca704de57c4f6c07bdbf14f75ec9

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    360B

    MD5

    3a1a83c2ffad464e87a2f9a502b7b9f1

    SHA1

    4ffa65ecdd0455499c8cd6d05947605340cbf426

    SHA256

    73ed949fba75a20288ac2d1e367180d4c8837fd31c66143707768d5b0e3bd8b6

    SHA512

    8232967faaf29b8b93b5042ba2bb1fcb6d0f0f2fa0e19573b1fe49f526ba434c5e76e932829e3c71beb0903e42c293ed202b619fee8aba93efe4a99e8aec55e2

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    476B

    MD5

    a5d4cddfecf34e5391a7a3df62312327

    SHA1

    04a3c708bab0c15b6746cf9dbf41a71c917a98b9

    SHA256

    8961a4310b2413753851ba8afe2feb4c522c20e856c6a98537d8ab440f48853a

    SHA512

    48024549d0fcb88e3bd46f7fb42715181142cae764a3daeb64cad07f10cf3bf14153731aeafba9a191557e29ddf1c5b62a460588823df215e2246eddaeff6643

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    701B

    MD5

    e427a32326a6a806e7b7b4fdbbe0ed4c

    SHA1

    b10626953332aeb7c524f2a29f47ca8b0bee38b1

    SHA256

    b5cfd1100679c495202229aede417b8a385405cb9d467d2d89b936fc99245839

    SHA512

    6bd679341bec6b224962f3d0d229cff2d400e568e10b7764eb4e0903c66819a8fa99927249ab9b4c447b2d09ea0d98eb9823fb2c5f7462112036049795a5d8bd

  • \Windows\SysWOW64\Tilecomgm.com

    Filesize

    207KB

    MD5

    03cae9ca903d0d948fd144ba9315a1a8

    SHA1

    c3929908918990100f1930c36509b37219aa1b85

    SHA256

    7b0deff51daba0c2967e71799ad43f2b7a53c36703051eb8e95bbe06df85c450

    SHA512

    385691a678941ad3bd116cb80d79c7daf55c36a097ed019392fceb2e884de7178d1a1eb2e5631b45fb5d3689c3a8056914541eed810d211c69780cb46d02e424

  • memory/1072-571-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1072-573-0x0000000002CE0000-0x0000000002D9C000-memory.dmp

    Filesize

    752KB

  • memory/1072-454-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1072-691-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1096-449-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1096-331-0x0000000002CE0000-0x0000000002D9C000-memory.dmp

    Filesize

    752KB

  • memory/1096-212-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1160-570-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1160-452-0x0000000002CE0000-0x0000000002D9C000-memory.dmp

    Filesize

    752KB

  • memory/1292-172-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/1292-163-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/1292-27-0x0000000002270000-0x0000000002271000-memory.dmp

    Filesize

    4KB

  • memory/1292-26-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/1292-25-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/1292-24-0x0000000002260000-0x0000000002261000-memory.dmp

    Filesize

    4KB

  • memory/1292-23-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/1292-22-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/1292-21-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/1292-20-0x0000000002220000-0x0000000002221000-memory.dmp

    Filesize

    4KB

  • memory/1292-19-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-18-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/1292-17-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-16-0x0000000000600000-0x0000000000601000-memory.dmp

    Filesize

    4KB

  • memory/1292-15-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/1292-14-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

  • memory/1292-13-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/1292-12-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/1292-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/1292-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-6-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1292-182-0x0000000002A10000-0x0000000002ACC000-memory.dmp

    Filesize

    752KB

  • memory/1292-181-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-180-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/1292-179-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/1292-178-0x00000000029A0000-0x00000000029A1000-memory.dmp

    Filesize

    4KB

  • memory/1292-177-0x0000000002970000-0x0000000002971000-memory.dmp

    Filesize

    4KB

  • memory/1292-176-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB

  • memory/1292-175-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1292-174-0x0000000002960000-0x0000000002961000-memory.dmp

    Filesize

    4KB

  • memory/1292-173-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/1292-29-0x0000000002290000-0x0000000002291000-memory.dmp

    Filesize

    4KB

  • memory/1292-171-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/1292-170-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/1292-169-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-168-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/1292-167-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/1292-166-0x00000000028E0000-0x00000000028E1000-memory.dmp

    Filesize

    4KB

  • memory/1292-165-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/1292-164-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/1292-28-0x00000000022A0000-0x00000000022A1000-memory.dmp

    Filesize

    4KB

  • memory/1292-162-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/1292-161-0x0000000002830000-0x0000000002831000-memory.dmp

    Filesize

    4KB

  • memory/1292-160-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/1292-187-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1292-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-0-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1292-2-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB

  • memory/1292-3-0x00000000001E0000-0x00000000001E4000-memory.dmp

    Filesize

    16KB

  • memory/1292-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1292-37-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/1292-36-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/1292-35-0x0000000002420000-0x0000000002421000-memory.dmp

    Filesize

    4KB

  • memory/1292-34-0x0000000002430000-0x0000000002431000-memory.dmp

    Filesize

    4KB

  • memory/1292-33-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/1292-32-0x00000000023F0000-0x00000000023F1000-memory.dmp

    Filesize

    4KB

  • memory/1292-31-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-30-0x00000000022C0000-0x00000000022C1000-memory.dmp

    Filesize

    4KB

  • memory/1292-204-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB

  • memory/1704-692-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2672-696-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2944-197-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

  • memory/2944-328-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2944-194-0x00000000006C0000-0x00000000006C1000-memory.dmp

    Filesize

    4KB

  • memory/2944-206-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2944-207-0x0000000000250000-0x0000000000280000-memory.dmp

    Filesize

    192KB

  • memory/2944-209-0x0000000002CE0000-0x0000000002D9C000-memory.dmp

    Filesize

    752KB

  • memory/2944-195-0x00000000006E0000-0x00000000006E1000-memory.dmp

    Filesize

    4KB

  • memory/2944-199-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/2944-198-0x0000000000740000-0x0000000000741000-memory.dmp

    Filesize

    4KB

  • memory/2944-196-0x0000000000700000-0x0000000000701000-memory.dmp

    Filesize

    4KB

  • memory/2944-190-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2944-193-0x00000000006A0000-0x00000000006A1000-memory.dmp

    Filesize

    4KB

  • memory/2944-329-0x0000000000250000-0x0000000000280000-memory.dmp

    Filesize

    192KB

  • memory/2944-200-0x00000000007C0000-0x00000000007C1000-memory.dmp

    Filesize

    4KB

  • memory/2944-201-0x00000000007E0000-0x00000000007E1000-memory.dmp

    Filesize

    4KB

  • memory/2944-202-0x0000000000800000-0x0000000000801000-memory.dmp

    Filesize

    4KB

  • memory/2944-203-0x0000000000820000-0x0000000000821000-memory.dmp

    Filesize

    4KB

  • memory/2944-189-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2944-188-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2944-191-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2944-192-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2944-186-0x0000000000250000-0x0000000000280000-memory.dmp

    Filesize

    192KB

  • memory/2944-185-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB