Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

a0d6a6e4eb...18.exe

windows7-x64

7

a0d6a6e4eb...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 02:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a0d6a6e4ebae0e39740e09f1628d7fda_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    a0d6a6e4ebae0e39740e09f1628d7fda

  • SHA1

    3040f4bc073903e12c36f56a12cb54c5b4cd5193

  • SHA256

    8686c7a85969f0745fdd310b49f4855b4797209031eaedb3b44fb83ace875172

  • SHA512

    9e2d49ab1b1d46588e71570611daf88dbf398495e5913c69e5af6bfaa88c86829b3586e226af562bd09419703b08c81a08e738d220c20568015d859f61eb90ad

  • SSDEEP

    24576:xYY+TBzrafXb8zsMb5U/TKY3cGSLivIJHTY5Nfaxsm4ki7CLJulh07HH4fbOW0Kv:xGJzsMq7DcGSLxUf0N5LJuKYqef

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 8 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 7 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d6a6e4ebae0e39740e09f1628d7fda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d6a6e4ebae0e39740e09f1628d7fda_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\progra~1\kingsoft\KSWebShield.exe
      C:\progra~1\kingsoft\KSWebShield.exe -install
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\progra~1\kingsoft\KSWebShield.exe
      C:\progra~1\kingsoft\KSWebShield.exe -start
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\lnk.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 5 127.0.0.1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4620
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4788
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:872
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1264
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:640
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3184
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4536
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2160
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3912
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:244
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4204
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4640
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╥┴╚╦┼«╨╘═°.url" /p everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5004
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2228
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2252
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2644
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1148
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:636
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4228
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\Desktop\╥┴╚╦┼«╨╘═°.url" +R +S
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1864
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3192
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3712
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3964
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3860
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2692
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2896
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4636
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:872
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4456
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2524
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4964
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4824
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\╥┴╚╦┼«╨╘═°.url" /p everyone:R
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2472
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.6626.net/?ukt-yt
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1028
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:17410 /prefetch:2
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:716
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:82952 /prefetch:2
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:244
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:82960 /prefetch:2
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:228
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.31166.net/?uk-yt
      2⤵
      • Modifies Internet Explorer settings
      PID:3860
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj-yt
      2⤵
      • Modifies Internet Explorer settings
      PID:516
  • C:\progra~1\kingsoft\KSWebShield.exe
    C:\progra~1\kingsoft\KSWebShield.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\progra~1\kingsoft\KSWebShield.exe
      C:\progra~1\kingsoft\KSWebShield.exe -run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini
    Filesize

    57B

    MD5

    5a4748b80129aae3995874a70cec08d1

    SHA1

    6ad41b07a54d4ded59d778faa273c6c4ad628bda

    SHA256

    b260556167ed0cc2512b38d01a1c003e6ff57bedfd0497d5e2195326d823dd85

    SHA512

    d9ec9c49c9f369795369edcac184e5ffa9b93a512a4156a109905dede95893c8dcdab344dc6aec959f3cd327cf603684dbdbf01bee6f2e960a53f56a1205d570

    Download Submit

  • C:\PROGRA~1\kingsoft\KWSSVC.log
    Filesize

    202B

    MD5

    1e9932706e4220119b078c346d4f4dfa

    SHA1

    2aaa44bee466ef8fe6503e64c2057d14ab3873c8

    SHA256

    68e87c48112488efe59bf97848aa216aad98b98ca47edab207caa3de976b1e9c

    SHA512

    92c32aa93152c82bd74b874251e9990116b5f6f69ce92ea66317db1eecb6350b62053d0834234b36f590c828e6e7411835e745c02dd01062f31f16d3f78d65b5

    Download Submit

  • C:\PROGRA~1\kingsoft\KWSSVC.log
    Filesize

    296B

    MD5

    6267f94451c2f255cf97e5fcdff3bfd9

    SHA1

    04f118e415d29d49c5025807bcb4bbd05a3c2d48

    SHA256

    5cef48aaa826d22ac8f76ef10b72faa61216202d21a55a962f859aec42eadbda

    SHA512

    9c7645d7601fce25f5c486ddeab1b48ec1c46bd22ba7fe47e68ce37ab4a444c1f2ba4b565944b8fefbbeb552fd624b4f3f6a965348a83d104b50a153d646f575

    Download Submit

  • C:\PROGRA~1\kingsoft\KWSSVC.log
    Filesize

    546B

    MD5

    b56710335a80eb328172c608f0fa79a8

    SHA1

    df0528f1e620722f2f9d2027c86bd752cc95af5b

    SHA256

    bf5237c8d93cd4df7f6f40921d5be0d6e52ae4faa749f6533d0c2c3be7b5dd52

    SHA512

    352f6c7c8a9f30460bf2ff56517a0215ed32901d572518f5c568e23439fff66fb71371164cfea2d1b44404498855377fa450765238f190933299a9417217ff55

    Download Submit

  • C:\Program Files\kingsoft\KSWebShield.dll
    Filesize

    437KB

    MD5

    0b629e4318e64a6ab7e2c43ad6cc3e83

    SHA1

    27e835072fb85614f49e7cd586f64bd10bfcd497

    SHA256

    41ef17fdff69930c658773f394f2f33f2f9ddab4b638e2b962da76a63a975be5

    SHA512

    298d43fb819a9257bdef1392bf68209423c82ea47f22f32657943dec0a6407be6ce8631e633b38e9d31df1ff9391b01010f6ff293835a1e6953dee09d30de24f

    Download Submit

  • C:\Program Files\kingsoft\kwssp.dll
    Filesize

    633KB

    MD5

    8c8dc085ab24bd23b77f146c78c8ff14

    SHA1

    3c01f9a5338fec055dd2fea36e468d160420a0b8

    SHA256

    ee50170b1c1829b98b647ea81d286f8a3630de1737be914ea02c409f1da1c217

    SHA512

    4754af26541d1737c8bae42a89c16570618b5bb5a44a4812f5e9819c852a2c6e235a9111bae98008037e94c614f4aabcf5166d041dce6e16be30683e80a1990c

    Download Submit

  • C:\Program Files\kingsoft\kwsui.dll
    Filesize

    457KB

    MD5

    272764640b4b296e13c7c136cfbaaca2

    SHA1

    8c4f405469d370db5270c64f119d5b5ba0eece4e

    SHA256

    50723b6ad935609de87df9f838756bdbb6cbdf801d3c0ce8e08cebb35ef04b3b

    SHA512

    97c4520913f968cf591d996c7aa82004455507d81f50968f8e7cbb5122b57be715c34b8de4f9d391195f4c1864747781b69632a8850119df4977524d002a604a

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lnk.bat
    Filesize

    1KB

    MD5

    90c75b8659294e166a60782eefc4f3bc

    SHA1

    97028e1233c09be6cefb6b3843dc477e56a98d56

    SHA256

    0c3e179547b62b770ab31f7cab5c3cbd3ac2019a3f467c6808763a125b500655

    SHA512

    7d33578c574f2f8b74a5379c616bd8e7cbcf4b1c65227c1a6e98287b6acf4edf259ffb4a68c0f39fe64b00ad3ce03be013acce5a11fbccea9a697fad13815b3a

    Download Submit

  • C:\Users\Admin\Favorites\ÃÀÅ®ÊÓƵ.url
    Filesize

    132B

    MD5

    2fb146f6106f90780ba1c46ac47a0b32

    SHA1

    73da10e5308c3724b12c86460ff5d3da32fec962

    SHA256

    3997b282de0d9d0aeb80df4dc545f62f6cac92018c78fec6f72e1daca3b6b545

    SHA512

    8b9763ad90dec9b5346453be4da661fcc8c51342f9825005aab2b6ff0593864ec8cf087d7c3253f2ec6f56cab6bff363b31f798f7e1ea78f7fe91ea1d8a47734

    Download Submit

  • C:\Users\Admin\Favorites\ÌÔ±¦¹ºÎï.url
    Filesize

    133B

    MD5

    08da998377776a44d7bb742f6a18f952

    SHA1

    635dadea1f8f772fa2752868ef039e62fedbbd48

    SHA256

    b593eaf8db263415e3b021e87ff07220ecc6e9940ccb2360aaaed24b130c143f

    SHA512

    9b312ff0f3ed4d7bd318192b3336a3fbcd53bb4fd1e1cd2528bace9ce2ca7574c27cfcd7fe33253a63b844116a1bb417ed19c69fbaba8e05c9e44adcae25a403

    Download Submit

  • C:\Users\Admin\Favorites\ÒÁÈËÅ®ÐÔÍø.url
    Filesize

    139B

    MD5

    bd792c47d0097b34a51f3f3cce6ad663

    SHA1

    c28259ba4f93302117f75fd4380f0c73c5662b60

    SHA256

    c97dea6c1248172ca8b3ba351f127d87e07acf851e025608e3d01eb1e5f0b413

    SHA512

    b672ec1f4d225b174c9c19457e970c3d9e924dcb58042909129c461ac872b7b153f661e0937e9351918cb60fcb53e0320f20026d7d373113e5263807b284d99c

    Download Submit

  • C:\Users\Admin\Favorites\ÔÚÏßµçÓ°.url
    Filesize

    141B

    MD5

    1b19102072a4801951e4852a62332364

    SHA1

    c4c34a89f3b474c9d22c0ca89f6d6fb6b5bb53ca

    SHA256

    f5a8018fec89146166b52ae67ad0359c6561c5b38e9e0ed6925692156c63926a

    SHA512

    6f7216dd7ed15a5014e2e80c82a7278f698488fbdaa10dd7a8ffa6821c8004beebd95ef362f4883bd28b12586d5503a728b8753d4b111e83721f3d5e68287f92

    Download Submit

  • C:\Users\Admin\Favorites\ÔÚÏßÂþ»­.url
    Filesize

    139B

    MD5

    22ac6a9e69c5789b0384ccc189325439

    SHA1

    0effc462f58d7079df7cf0631ad5c395997d9f0f

    SHA256

    c7b3b920559e1b7afa8a2f263d0998a1b55750170e126c4ffc018e4f9cb38c6f

    SHA512

    1c1a1ab2b5deebca0e4e6bdf5a432fbc5e7989204b3c5c32d4b0c104c16c3bb67f7895788d1bf4c24c0a7eacd35087c829d99fc194e8a8018d8aee338bb95cfd

    Download Submit

  • C:\progra~1\kingsoft\KSWebShield.exe
    Filesize

    197KB

    MD5

    2bcfdc7e51a9c556e5fb04e4d02fed39

    SHA1

    33e6eca60078affa733c2300605c91adddf992b0

    SHA256

    ee47b58a5464ceb75d73a82935a217970270958030eabc4e03100c61e7222fb1

    SHA512

    86b7a88d0aa5bacac2fd2a1eb60b5ac80a0fe012a1fb9105b7d7071e594a73e8fa049bebcbde144acc2e8116f682f47286d56c1302dd7153902fa5c2d617881c

    Download Submit

  • memory/844-29-0x00000000006F0000-0x0000000000760000-memory.dmp

    Filesize

    448KB

    Download

  • memory/3920-100-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-129-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-89-0x0000000000401000-0x00000000006C5000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3920-88-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-0-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-37-0x00000000057E0000-0x0000000005850000-memory.dmp

    Filesize

    448KB

    Download

  • memory/3920-113-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-123-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-128-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-87-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-130-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-131-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-1-0x0000000000401000-0x00000000006C5000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3920-144-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-147-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-148-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-149-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-150-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/3920-151-0x0000000000400000-0x0000000000847000-memory.dmp

    Filesize

    4.3MB

    Download