Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 13:04

General

  • Target

    e28b8f9d02d44890d09099f68b329914_JaffaCakes118.exe

  • Size

    203KB

  • MD5

    e28b8f9d02d44890d09099f68b329914

  • SHA1

    be447005c84a84cec99e9ba236e056d9277244d7

  • SHA256

    9230440aec3a46b96805fee5641b42516dba51465c5306638d1d0924c07b6a55

  • SHA512

    9c434a694920deb240ff0f3707a5705ff5c7d09aedf0a15cb9eefc51a6265dd41477011a44ce1621676b71af52d79d7378137c90476b7ca7cc375d439fc2333c

  • SSDEEP

    3072:4PvBxdw7brTsht8nK2ZzaHWdTC1EFWmGwJlHk2S8McSGfJIzlgDz9EbbwWNIZKbf:l7bioK2ouTC6FewJlV7YHZIz9EwKS

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 46 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e28b8f9d02d44890d09099f68b329914_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e28b8f9d02d44890d09099f68b329914_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\igfxdkv32.exe
      "C:\Windows\system32\igfxdkv32.exe" C:\Users\Admin\AppData\Local\Temp\E28B8F~1.EXE
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\SysWOW64\igfxdkv32.exe
        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\SysWOW64\igfxdkv32.exe
          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Maps connected drives based on registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\SysWOW64\igfxdkv32.exe
            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Maps connected drives based on registry
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1460
            • C:\Windows\SysWOW64\igfxdkv32.exe
              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2408
              • C:\Windows\SysWOW64\igfxdkv32.exe
                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1228
                • C:\Windows\SysWOW64\igfxdkv32.exe
                  "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1420
                  • C:\Windows\SysWOW64\igfxdkv32.exe
                    "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Maps connected drives based on registry
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1708
                    • C:\Windows\SysWOW64\igfxdkv32.exe
                      "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1188
                      • C:\Windows\SysWOW64\igfxdkv32.exe
                        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Maps connected drives based on registry
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2168
                        • C:\Windows\SysWOW64\igfxdkv32.exe
                          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2160
                          • C:\Windows\SysWOW64\igfxdkv32.exe
                            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Maps connected drives based on registry
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2344
                            • C:\Windows\SysWOW64\igfxdkv32.exe
                              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2496
                              • C:\Windows\SysWOW64\igfxdkv32.exe
                                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Maps connected drives based on registry
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1888
                                • C:\Windows\SysWOW64\igfxdkv32.exe
                                  "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Maps connected drives based on registry
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:328
                                  • C:\Windows\SysWOW64\igfxdkv32.exe
                                    "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Maps connected drives based on registry
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3036
                                    • C:\Windows\SysWOW64\igfxdkv32.exe
                                      "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Maps connected drives based on registry
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2144
                                      • C:\Windows\SysWOW64\igfxdkv32.exe
                                        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Maps connected drives based on registry
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1932
                                        • C:\Windows\SysWOW64\igfxdkv32.exe
                                          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2016
                                          • C:\Windows\SysWOW64\igfxdkv32.exe
                                            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Maps connected drives based on registry
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3028
                                            • C:\Windows\SysWOW64\igfxdkv32.exe
                                              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Maps connected drives based on registry
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2696
                                              • C:\Windows\SysWOW64\igfxdkv32.exe
                                                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Maps connected drives based on registry
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2960
                                                • C:\Windows\SysWOW64\igfxdkv32.exe
                                                  "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Maps connected drives based on registry
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2352
                                                  • C:\Windows\SysWOW64\igfxdkv32.exe
                                                    "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Maps connected drives based on registry
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2376
                                                    • C:\Windows\SysWOW64\igfxdkv32.exe
                                                      "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Maps connected drives based on registry
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1416
                                                      • C:\Windows\SysWOW64\igfxdkv32.exe
                                                        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1232
                                                        • C:\Windows\SysWOW64\igfxdkv32.exe
                                                          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Maps connected drives based on registry
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1228
                                                          • C:\Windows\SysWOW64\igfxdkv32.exe
                                                            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Maps connected drives based on registry
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2508
                                                            • C:\Windows\SysWOW64\igfxdkv32.exe
                                                              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2292
                                                              • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Maps connected drives based on registry
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:808
                                                                • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                  "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Maps connected drives based on registry
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2316
                                                                  • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                    "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Maps connected drives based on registry
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1880
                                                                    • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                      "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Maps connected drives based on registry
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2172
                                                                      • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Maps connected drives based on registry
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2344
                                                                        • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Maps connected drives based on registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2068
                                                                          • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Maps connected drives based on registry
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1620
                                                                            • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Maps connected drives based on registry
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1308
                                                                              • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Maps connected drives based on registry
                                                                                • Drops file in System32 directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2212
                                                                                • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                  "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Maps connected drives based on registry
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2920
                                                                                  • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                    "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Maps connected drives based on registry
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:288
                                                                                    • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                      "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Maps connected drives based on registry
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1704
                                                                                      • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                        "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Maps connected drives based on registry
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:900
                                                                                        • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                          "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Maps connected drives based on registry
                                                                                          • Drops file in System32 directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1604
                                                                                          • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                            "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Maps connected drives based on registry
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1900
                                                                                            • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                              "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Maps connected drives based on registry
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3028
                                                                                              • C:\Windows\SysWOW64\igfxdkv32.exe
                                                                                                "C:\Windows\system32\igfxdkv32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Maps connected drives based on registry
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\igfxdkv32.exe

    Filesize

    203KB

    MD5

    e28b8f9d02d44890d09099f68b329914

    SHA1

    be447005c84a84cec99e9ba236e056d9277244d7

    SHA256

    9230440aec3a46b96805fee5641b42516dba51465c5306638d1d0924c07b6a55

    SHA512

    9c434a694920deb240ff0f3707a5705ff5c7d09aedf0a15cb9eefc51a6265dd41477011a44ce1621676b71af52d79d7378137c90476b7ca7cc375d439fc2333c

  • memory/288-180-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/328-106-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/328-101-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/808-154-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/808-156-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/900-184-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1188-64-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1188-70-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1228-145-0x0000000003710000-0x000000000379B000-memory.dmp

    Filesize

    556KB

  • memory/1228-148-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1228-47-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1228-51-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1228-144-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1232-141-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1232-143-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1308-171-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1308-173-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1416-140-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1416-138-0x0000000003130000-0x00000000031BB000-memory.dmp

    Filesize

    556KB

  • memory/1420-58-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1460-39-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1460-33-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1604-185-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1604-188-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1620-170-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1704-182-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1708-62-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1880-160-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1888-99-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1900-191-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1900-186-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1932-117-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1932-120-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/1932-118-0x00000000032C0000-0x000000000334B000-memory.dmp

    Filesize

    556KB

  • memory/2016-122-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2068-168-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2068-166-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2144-114-0x0000000002AB0000-0x0000000002B3B000-memory.dmp

    Filesize

    556KB

  • memory/2144-116-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2160-81-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2168-71-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2168-75-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2172-163-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2172-161-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2212-175-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2280-35-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2292-151-0x0000000003240000-0x00000000032CB000-memory.dmp

    Filesize

    556KB

  • memory/2292-153-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2292-150-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2316-158-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2344-86-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2344-83-0x0000000002A70000-0x0000000002AFB000-memory.dmp

    Filesize

    556KB

  • memory/2344-165-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2352-132-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2352-135-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2376-137-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2376-133-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2408-46-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2496-95-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2496-93-0x00000000032B0000-0x000000000333B000-memory.dmp

    Filesize

    556KB

  • memory/2496-88-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2508-146-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2508-149-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2632-12-0x00000000030F0000-0x000000000317B000-memory.dmp

    Filesize

    556KB

  • memory/2632-16-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2632-2-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2632-0-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2632-13-0x00000000030F0000-0x000000000317B000-memory.dmp

    Filesize

    556KB

  • memory/2632-1-0x0000000000220000-0x0000000000222000-memory.dmp

    Filesize

    8KB

  • memory/2696-128-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2696-124-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2708-27-0x0000000003250000-0x00000000032DB000-memory.dmp

    Filesize

    556KB

  • memory/2708-29-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2764-17-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2764-23-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2920-176-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2920-178-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2960-131-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/2960-129-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3028-126-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3028-123-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3028-189-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3028-194-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3028-192-0x00000000038B0000-0x000000000393B000-memory.dmp

    Filesize

    556KB

  • memory/3036-107-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3036-112-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3036-110-0x0000000003840000-0x00000000038CB000-memory.dmp

    Filesize

    556KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.