Overview

overview

10

Static

static

3

07ff01a598...18.exe

windows7-x64

10

07ff01a598...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    65s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 16:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe

  • Size

    827KB

  • MD5

    07ff01a5981a62f881098f91c9d8dc2a

  • SHA1

    05fcc7a610350324c40c9038db895f81efe1eb6f

  • SHA256

    c8ceb7f27b3cedffabd4abaae3688b9b41d794f583ece6d7cb456a84f920aa8b

  • SHA512

    2d70d118aee55051100485483724e194e9949e391d2420829288df9d362a59be1a26880ad419117f7f08d6b46c9754194110a177867976b40b7d1c217d499965

  • SSDEEP

    24576:OA/sWp8oMJMCRcxNWdm1D43yT2ZWW4Dt9pYOtRtFtp:OA/+o85RcXWdmZdT294tXp

Score
10/10
salitybackdoorbootkitevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 21 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 7 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 42 IoCs
    evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 42 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 20 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 16 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 10 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 23 IoCs
  • Drops file in Windows directory 8 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1124
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1184
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1224
          • C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe"
            2⤵
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe"
              3⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Loads dropped DLL
              • Windows security modification
              • Checks whether UAC is enabled
              • Maps connected drives based on registry
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2736
              • C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2156
                • C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
                  C:\Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
                  5⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2528
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    6⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Boot or Logon Autostart Execution: Active Setup
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2332
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1220
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Deletes itself
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:2412
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1772
                          • C:\Windows\windows\explorer.exe
                            C:\Windows\windows\explorer.exe
                            10⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Windows directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1928
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2848
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:712
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:1936
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1952
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2064
                          • C:\Windows\windows\explorer.exe
                            C:\Windows\windows\explorer.exe
                            10⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Windows directory
                            • Suspicious use of SetWindowsHookEx
                            PID:2288
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:2548
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:2460
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2676
                          • C:\Windows\windows\explorer.exe
                            C:\Windows\windows\explorer.exe
                            10⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Windows directory
                            • Suspicious use of SetWindowsHookEx
                            PID:2704
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:1676
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:2216
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          PID:336
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:1828
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2000
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:600
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:3060
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2372
                          • C:\Windows\windows\explorer.exe
                            C:\Windows\windows\explorer.exe
                            10⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Windows directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1600
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:2552
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Executes dropped EXE
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:2512
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1988
                          • C:\Windows\windows\explorer.exe
                            C:\Windows\windows\explorer.exe
                            10⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Windows directory
                            • Suspicious use of SetWindowsHookEx
                            PID:2400
                    • C:\Windows\windows\explorer.exe
                      "C:\Windows\windows\explorer.exe"
                      7⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      PID:2224
                      • C:\Windows\windows\explorer.exe
                        "C:\Windows\windows\explorer.exe"
                        8⤵
                        • Executes dropped EXE
                        • Maps connected drives based on registry
                        • Suspicious use of SetWindowsHookEx
                        PID:1160
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          9⤵
                            PID:1516
                            • C:\Windows\windows\explorer.exe
                              C:\Windows\windows\explorer.exe
                              10⤵
                                PID:1556
                        • C:\Windows\windows\explorer.exe
                          "C:\Windows\windows\explorer.exe"
                          7⤵
                            PID:1668
                            • C:\Windows\windows\explorer.exe
                              "C:\Windows\windows\explorer.exe"
                              8⤵
                                PID:1136
                                • C:\Windows\windows\explorer.exe
                                  "C:\Windows\windows\explorer.exe"
                                  9⤵
                                    PID:1304
                                    • C:\Windows\windows\explorer.exe
                                      C:\Windows\windows\explorer.exe
                                      10⤵
                                        PID:2828
                                • C:\Windows\windows\explorer.exe
                                  "C:\Windows\windows\explorer.exe"
                                  7⤵
                                    PID:2600
                                    • C:\Windows\windows\explorer.exe
                                      "C:\Windows\windows\explorer.exe"
                                      8⤵
                                        PID:2292
                                        • C:\Windows\windows\explorer.exe
                                          "C:\Windows\windows\explorer.exe"
                                          9⤵
                                            PID:2672
                                            • C:\Windows\windows\explorer.exe
                                              C:\Windows\windows\explorer.exe
                                              10⤵
                                                PID:2696
                                        • C:\Windows\windows\explorer.exe
                                          "C:\Windows\windows\explorer.exe"
                                          7⤵
                                            PID:1840
                                            • C:\Windows\windows\explorer.exe
                                              "C:\Windows\windows\explorer.exe"
                                              8⤵
                                                PID:2752
                                            • C:\Windows\windows\explorer.exe
                                              "C:\Windows\windows\explorer.exe"
                                              7⤵
                                                PID:1948
                                                • C:\Windows\windows\explorer.exe
                                                  "C:\Windows\windows\explorer.exe"
                                                  8⤵
                                                    PID:1780
                                                    • C:\Windows\windows\explorer.exe
                                                      "C:\Windows\windows\explorer.exe"
                                                      9⤵
                                                        PID:584
                                                        • C:\Windows\windows\explorer.exe
                                                          C:\Windows\windows\explorer.exe
                                                          10⤵
                                                            PID:968
                                                    • C:\Windows\windows\explorer.exe
                                                      "C:\Windows\windows\explorer.exe"
                                                      7⤵
                                                        PID:1236
                                                        • C:\Windows\windows\explorer.exe
                                                          "C:\Windows\windows\explorer.exe"
                                                          8⤵
                                                            PID:1096
                                                            • C:\Windows\windows\explorer.exe
                                                              "C:\Windows\windows\explorer.exe"
                                                              9⤵
                                                                PID:2404
                                                                • C:\Windows\windows\explorer.exe
                                                                  C:\Windows\windows\explorer.exe
                                                                  10⤵
                                                                    PID:2996
                                                            • C:\Windows\windows\explorer.exe
                                                              "C:\Windows\windows\explorer.exe"
                                                              7⤵
                                                                PID:1376
                                                                • C:\Windows\windows\explorer.exe
                                                                  "C:\Windows\windows\explorer.exe"
                                                                  8⤵
                                                                    PID:1760
                                                                • C:\Windows\windows\explorer.exe
                                                                  "C:\Windows\windows\explorer.exe"
                                                                  7⤵
                                                                    PID:1624
                                                                    • C:\Windows\windows\explorer.exe
                                                                      "C:\Windows\windows\explorer.exe"
                                                                      8⤵
                                                                        PID:2076
                                                                        • C:\Windows\windows\explorer.exe
                                                                          "C:\Windows\windows\explorer.exe"
                                                                          9⤵
                                                                            PID:1012
                                                                            • C:\Windows\windows\explorer.exe
                                                                              C:\Windows\windows\explorer.exe
                                                                              10⤵
                                                                                PID:2712
                                                            • C:\Windows\system32\DllHost.exe
                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                              1⤵
                                                                PID:632

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Active Setup

                                                              1
                                                              T1547.014

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Create or Modify System Process

                                                              1
                                                              T1543

                                                              Windows Service

                                                              1
                                                              T1543.003

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Privilege Escalation

                                                              Abuse Elevation Control Mechanism

                                                              1
                                                              T1548

                                                              Bypass User Account Control

                                                              1
                                                              T1548.002

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Active Setup

                                                              1
                                                              T1547.014

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Create or Modify System Process

                                                              1
                                                              T1543

                                                              Windows Service

                                                              1
                                                              T1543.003

                                                              Defense Evasion

                                                              Abuse Elevation Control Mechanism

                                                              1
                                                              T1548

                                                              Bypass User Account Control

                                                              1
                                                              T1548.002

                                                              Impair Defenses

                                                              4
                                                              T1562

                                                              Disable or Modify System Firewall

                                                              1
                                                              T1562.004

                                                              Disable or Modify Tools

                                                              3
                                                              T1562.001

                                                              Modify Registry

                                                              7
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Credential Access

                                                              Discovery

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              2
                                                              T1012

                                                              System Information Discovery

                                                              3
                                                              T1082

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Windows\SYSTEM.INI
                                                                Filesize

                                                                257B

                                                                MD5

                                                                47ce8973a641ce030a4e451241ca566f

                                                                SHA1

                                                                1e9a42b046707808703a61929795f16ed5436a4b

                                                                SHA256

                                                                1a8734f559071d53528d7897542d9c95181abc60aa532a8baf40fb50b58d5ef8

                                                                SHA512

                                                                ffe2ee886eef3476c09759cd4a5af7fabd164470c046ca37714f8532b7ce18a859d5c9334cd2c66a34b4a5dcbedeccb3011be6b10f246270d8d549ec92d190f0

                                                                Download Submit

                                                              • C:\jrvuan.exe
                                                                Filesize

                                                                100KB

                                                                MD5

                                                                3a7dcc7e7ddbcddef0e804d61dbf29d6

                                                                SHA1

                                                                027bd3b77e3956f1453876757f619c58c7b8b715

                                                                SHA256

                                                                07cc8cd052d2e9f5882ba48e1512c6c31bc18967191085cfdc2078184c6a98ef

                                                                SHA512

                                                                51c7954939d9e15cc9bbb2e4de7ee57415966a3d176b4564941577d22925a2387b0820fb8e59e8c403f551e31128cffc8abfb421ec266b32290b3e35421826ae

                                                                Download Submit

                                                              • \Users\Admin\AppData\Local\Temp\07ff01a5981a62f881098f91c9d8dc2a_JaffaCakes118.exe
                                                                Filesize

                                                                827KB

                                                                MD5

                                                                07ff01a5981a62f881098f91c9d8dc2a

                                                                SHA1

                                                                05fcc7a610350324c40c9038db895f81efe1eb6f

                                                                SHA256

                                                                c8ceb7f27b3cedffabd4abaae3688b9b41d794f583ece6d7cb456a84f920aa8b

                                                                SHA512

                                                                2d70d118aee55051100485483724e194e9949e391d2420829288df9d362a59be1a26880ad419117f7f08d6b46c9754194110a177867976b40b7d1c217d499965

                                                                Download Submit

                                                              • memory/600-492-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/600-483-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/712-200-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/712-191-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1124-57-0x0000000000160000-0x0000000000162000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/1136-781-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1136-812-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1160-697-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1160-726-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1220-127-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1220-138-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1668-779-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1668-768-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1676-407-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1676-398-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1780-956-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/1828-480-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1828-542-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1840-896-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1840-885-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1936-253-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1948-945-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1948-957-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1952-299-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2000-554-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2000-546-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2156-110-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/2156-100-0x0000000001D40000-0x0000000001E5E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2156-79-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/2156-81-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/2216-470-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2224-693-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2292-913-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2292-877-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2332-666-0x0000000002C00000-0x0000000002D1E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-125-0x0000000002860000-0x000000000297E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-762-0x0000000002C00000-0x0000000002D1E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-767-0x0000000004780000-0x000000000489E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-844-0x0000000004570000-0x000000000468E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-682-0x0000000004570000-0x000000000468E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-944-0x0000000004250000-0x000000000436E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-479-0x0000000002C00000-0x0000000002D1E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-320-0x0000000002860000-0x000000000297E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-591-0x0000000002C00000-0x0000000002D1E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-847-0x0000000004250000-0x000000000436E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-243-0x0000000002860000-0x000000000297E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-240-0x0000000002860000-0x000000000297E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-900-0x0000000004780000-0x000000000489E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2332-884-0x0000000004250000-0x000000000436E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2412-139-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2412-222-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2460-381-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2512-651-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2528-102-0x0000000010000000-0x000000001031C000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/2528-104-0x0000000010000000-0x000000001031C000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/2528-112-0x0000000010000000-0x000000001031C000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/2528-101-0x0000000010000000-0x000000001031C000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/2528-106-0x0000000010000000-0x000000001031C000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/2548-330-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2548-321-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2552-598-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2552-637-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2600-875-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2600-848-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2736-55-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-31-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-82-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-85-0x0000000000320000-0x0000000000322000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/2736-78-0x0000000005080000-0x000000000519E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2736-76-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-75-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-72-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-73-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-74-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-98-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2736-45-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-47-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-46-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-48-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-44-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-43-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-37-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-50-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-70-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2736-71-0x0000000000320000-0x0000000000322000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/2736-56-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-68-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2736-67-0x0000000000320000-0x0000000000322000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/2736-52-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-51-0x0000000002980000-0x0000000003A0E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                                Download

                                                              • memory/2736-35-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2736-33-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2752-907-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2752-901-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download

                                                              • memory/2848-188-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2848-177-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2940-42-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2940-17-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-12-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-11-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-10-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-9-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-8-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-7-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-6-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-4-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-3-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-13-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-16-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-1-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-14-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-24-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-25-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-27-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-28-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-29-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-26-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-18-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-0-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2940-19-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-15-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-20-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-21-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-22-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/2940-30-0x0000000002640000-0x000000000275E000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2940-23-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/3060-576-0x0000000000400000-0x00000000005AA000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                                Download