Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 22:26 UTC

General

  • Target

    f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe

  • Size

    361KB

  • MD5

    f6050e141fd57f5bd30f6a6a59200002

  • SHA1

    d94b5a399974d5c1b3c61fea2d8f96c32f4dbd95

  • SHA256

    dbb9c508474f2afac3b0f9addb0d617773bfd4ea47b2e0d55d8833d11b420f67

  • SHA512

    b521eec5d49d2ade2b3e279ca3b1552ac05a0bf4b330d0129c14ada621675d1d49acc1c5b7327a55c0eb9aa44fd34cc2f49580af7918d198d37627148b0e6df2

  • SSDEEP

    3072:7D0Gvk2CF0CYG/ci9Hye10KNvfbRPcFO5/9oyvmMXGfI5XFz4lnDIA4FArOyTDcG:knLYIPeKZF0FO5/9oyOMXGCA4dQwg

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 49 IoCs
  • Loads dropped DLL 64 IoCs
  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\SysWOW64\igfxscr32.exe
      "C:\Windows\system32\igfxscr32.exe" C:\Users\Admin\AppData\Local\Temp\F6050E~1.EXE
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\igfxscr32.exe
        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\igfxscr32.exe
          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\SysWOW64\igfxscr32.exe
            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Maps connected drives based on registry
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:556
            • C:\Windows\SysWOW64\igfxscr32.exe
              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Windows\SysWOW64\igfxscr32.exe
                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Maps connected drives based on registry
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1908
                • C:\Windows\SysWOW64\igfxscr32.exe
                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:676
                  • C:\Windows\SysWOW64\igfxscr32.exe
                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:868
                    • C:\Windows\SysWOW64\igfxscr32.exe
                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Maps connected drives based on registry
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2264
                      • C:\Windows\SysWOW64\igfxscr32.exe
                        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Maps connected drives based on registry
                        • System Location Discovery: System Language Discovery
                        PID:2236
                        • C:\Windows\SysWOW64\igfxscr32.exe
                          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1948
                          • C:\Windows\SysWOW64\igfxscr32.exe
                            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Maps connected drives based on registry
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2488
                            • C:\Windows\SysWOW64\igfxscr32.exe
                              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Maps connected drives based on registry
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1468
                              • C:\Windows\SysWOW64\igfxscr32.exe
                                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Maps connected drives based on registry
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:536
                                • C:\Windows\SysWOW64\igfxscr32.exe
                                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Maps connected drives based on registry
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1884
                                  • C:\Windows\SysWOW64\igfxscr32.exe
                                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Maps connected drives based on registry
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3040
                                    • C:\Windows\SysWOW64\igfxscr32.exe
                                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Maps connected drives based on registry
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1548
                                      • C:\Windows\SysWOW64\igfxscr32.exe
                                        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:2540
                                        • C:\Windows\SysWOW64\igfxscr32.exe
                                          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          PID:2188
                                          • C:\Windows\SysWOW64\igfxscr32.exe
                                            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Maps connected drives based on registry
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            PID:896
                                            • C:\Windows\SysWOW64\igfxscr32.exe
                                              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Maps connected drives based on registry
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              PID:3044
                                              • C:\Windows\SysWOW64\igfxscr32.exe
                                                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Maps connected drives based on registry
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                PID:2432
                                                • C:\Windows\SysWOW64\igfxscr32.exe
                                                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Maps connected drives based on registry
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2704
                                                  • C:\Windows\SysWOW64\igfxscr32.exe
                                                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Maps connected drives based on registry
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1916
                                                    • C:\Windows\SysWOW64\igfxscr32.exe
                                                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Maps connected drives based on registry
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:680
                                                      • C:\Windows\SysWOW64\igfxscr32.exe
                                                        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Maps connected drives based on registry
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1508
                                                        • C:\Windows\SysWOW64\igfxscr32.exe
                                                          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Maps connected drives based on registry
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3020
                                                          • C:\Windows\SysWOW64\igfxscr32.exe
                                                            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Maps connected drives based on registry
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:448
                                                            • C:\Windows\SysWOW64\igfxscr32.exe
                                                              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1996
                                                              • C:\Windows\SysWOW64\igfxscr32.exe
                                                                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Maps connected drives based on registry
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1980
                                                                • C:\Windows\SysWOW64\igfxscr32.exe
                                                                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Maps connected drives based on registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1268
                                                                  • C:\Windows\SysWOW64\igfxscr32.exe
                                                                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Maps connected drives based on registry
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1000
                                                                    • C:\Windows\SysWOW64\igfxscr32.exe
                                                                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Maps connected drives based on registry
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2120
                                                                      • C:\Windows\SysWOW64\igfxscr32.exe
                                                                        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2164
                                                                        • C:\Windows\SysWOW64\igfxscr32.exe
                                                                          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Maps connected drives based on registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2636
                                                                          • C:\Windows\SysWOW64\igfxscr32.exe
                                                                            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Maps connected drives based on registry
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2928
                                                                            • C:\Windows\SysWOW64\igfxscr32.exe
                                                                              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Maps connected drives based on registry
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2504
                                                                              • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Maps connected drives based on registry
                                                                                • Drops file in System32 directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2920
                                                                                • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Maps connected drives based on registry
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:992
                                                                                  • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2564
                                                                                    • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Maps connected drives based on registry
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1232
                                                                                      • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                        "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Maps connected drives based on registry
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1284
                                                                                        • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                          "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Maps connected drives based on registry
                                                                                          • Drops file in System32 directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2456
                                                                                          • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                            "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Maps connected drives based on registry
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2476
                                                                                            • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                              "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2368
                                                                                              • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                                "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Maps connected drives based on registry
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2412
                                                                                                • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                                  "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Maps connected drives based on registry
                                                                                                  • Drops file in System32 directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2900
                                                                                                  • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                                    "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2748
                                                                                                    • C:\Windows\SysWOW64\igfxscr32.exe
                                                                                                      "C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Maps connected drives based on registry
                                                                                                      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\igfxscr32.exe

    Filesize

    361KB

    MD5

    f6050e141fd57f5bd30f6a6a59200002

    SHA1

    d94b5a399974d5c1b3c61fea2d8f96c32f4dbd95

    SHA256

    dbb9c508474f2afac3b0f9addb0d617773bfd4ea47b2e0d55d8833d11b420f67

    SHA512

    b521eec5d49d2ade2b3e279ca3b1552ac05a0bf4b330d0129c14ada621675d1d49acc1c5b7327a55c0eb9aa44fd34cc2f49580af7918d198d37627148b0e6df2

  • memory/448-181-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/448-184-0x00000000030D0000-0x000000000315E000-memory.dmp

    Filesize

    568KB

  • memory/448-187-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/536-125-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/556-46-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/556-53-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/676-71-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/680-173-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/680-170-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/868-81-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/868-74-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/896-156-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/992-223-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/992-227-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1000-197-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1000-200-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1112-28-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1112-24-0x0000000003100000-0x000000000318E000-memory.dmp

    Filesize

    568KB

  • memory/1112-20-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1112-19-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1232-236-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1232-233-0x00000000031B0000-0x000000000323E000-memory.dmp

    Filesize

    568KB

  • memory/1232-231-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1268-196-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1284-237-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1284-241-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1468-115-0x0000000003120000-0x00000000031AE000-memory.dmp

    Filesize

    568KB

  • memory/1468-117-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1472-41-0x00000000032C0000-0x000000000334E000-memory.dmp

    Filesize

    568KB

  • memory/1472-38-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1472-45-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1508-232-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1508-176-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1548-147-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1884-126-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1884-132-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1908-59-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1908-67-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1916-168-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1916-171-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1948-105-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1980-193-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1996-189-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1996-185-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2120-205-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2120-14-0x0000000002FD0000-0x000000000305E000-memory.dmp

    Filesize

    568KB

  • memory/2120-18-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2120-13-0x0000000002FD0000-0x000000000305E000-memory.dmp

    Filesize

    568KB

  • memory/2120-202-0x0000000003160000-0x00000000031EE000-memory.dmp

    Filesize

    568KB

  • memory/2120-3-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2120-2-0x000000000046B000-0x000000000047E000-memory.dmp

    Filesize

    76KB

  • memory/2120-0-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2120-1-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2164-203-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2164-208-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2188-153-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2188-151-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2236-99-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2236-98-0x0000000002CC0000-0x000000000390A000-memory.dmp

    Filesize

    12.3MB

  • memory/2236-97-0x0000000074BA0000-0x0000000074BC7000-memory.dmp

    Filesize

    156KB

  • memory/2236-96-0x00000000023B0000-0x00000000024A5000-memory.dmp

    Filesize

    980KB

  • memory/2236-95-0x0000000077520000-0x000000007761A000-memory.dmp

    Filesize

    1000KB

  • memory/2236-94-0x0000000077400000-0x000000007751F000-memory.dmp

    Filesize

    1.1MB

  • memory/2236-91-0x0000000003100000-0x000000000318E000-memory.dmp

    Filesize

    568KB

  • memory/2264-82-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2264-86-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2284-61-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2284-58-0x0000000003020000-0x00000000030AE000-memory.dmp

    Filesize

    568KB

  • memory/2368-252-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2412-254-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2412-250-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2432-218-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2432-163-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2432-160-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2456-239-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2456-244-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2476-248-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2476-245-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2488-110-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2504-217-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2504-213-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2540-150-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2540-145-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2564-225-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2564-230-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2636-210-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2696-33-0x0000000003210000-0x000000000329E000-memory.dmp

    Filesize

    568KB

  • memory/2696-37-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2696-29-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2704-167-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2704-165-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2748-261-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2900-258-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2920-222-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2928-215-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/3020-179-0x0000000003010000-0x000000000309E000-memory.dmp

    Filesize

    568KB

  • memory/3020-182-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/3020-177-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/3040-138-0x0000000003260000-0x00000000032EE000-memory.dmp

    Filesize

    568KB

  • memory/3040-140-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/3044-159-0x0000000004880000-0x000000000490E000-memory.dmp

    Filesize

    568KB

  • memory/3044-162-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/3044-157-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.