Overview

overview

10

Static

static

10

JaffaCakes...43.exe

windows7-x64

10

JaffaCakes...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2025 10:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_27a73345395e11ee30b69500b9799943.exe

  • Size

    667KB

  • MD5

    27a73345395e11ee30b69500b9799943

  • SHA1

    3a4da42a87d936fc623b110b5cdcf5df1c16c076

  • SHA256

    1063a2bc84cdc0ef654ca50790de4976f8493a7b9c304bc8aabde15ce1b54210

  • SHA512

    105042e974dadf6bee439056b8e61d2969c7451ee93c721350b68ffec16c1d41407748ed931b9d5785fa9b19a98211e61ba46287c2da4fac6b72fc4cb0b03e53

  • SSDEEP

    12288:WbMqmCEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WI8EEb4Ev/ATEXKGVnGTzpA1Ec1A

Score
10/10
cycbotmodiloaderbackdoordiscoveryevasionpersistencerattrojanupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 7 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a73345395e11ee30b69500b9799943.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a73345395e11ee30b69500b9799943.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a73345395e11ee30b69500b9799943.exe
      JaffaCakes118_27a73345395e11ee30b69500b9799943.exe
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Users\Admin\DV245F.exe
        C:\Users\Admin\DV245F.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Users\Admin\huomuz.exe
          "C:\Users\Admin\huomuz.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4428
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del DV245F.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4016
      • C:\Users\Admin\aohost.exe
        C:\Users\Admin\aohost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Users\Admin\aohost.exe
          aohost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1432
      • C:\Users\Admin\bohost.exe
        C:\Users\Admin\bohost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3236
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\7D75D\85BB8.exe%C:\Users\Admin\AppData\Roaming\7D75D
          4⤵
          • Executes dropped EXE
          PID:1364
        • C:\Users\Admin\bohost.exe
          C:\Users\Admin\bohost.exe startC:\Program Files (x86)\5D57E\lvvm.exe%C:\Program Files (x86)\5D57E
          4⤵
          • Executes dropped EXE
          PID:2736
      • C:\Users\Admin\dohost.exe
        C:\Users\Admin\dohost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_27a73345395e11ee30b69500b9799943.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1476
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:816
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5108
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3272
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2612
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2648
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2492
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2360
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4996
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4240
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1660
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:556
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:396
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1628
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

6
T1112

Credential Access

Discovery

Peripheral Device Discovery

3
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    471B

    MD5

    33b6a15b1397a410fb5624043946dbdf

    SHA1

    142c35062d9b18d960e3eeaf947b86fffd8803a5

    SHA256

    6c230484759e30e5fa400fa608b58ccd2c0faaa37b245068fb961dc95d39a998

    SHA512

    27d4e2643a2b5bf28a07c137c9a6dcabb251f5b433b9f38c3bd9a616d55f6dc7a659f3c9e05e6a3f91c6dd96cd9988bcdabd39d3a7a550ad72cac48bdff7be0b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    412B

    MD5

    e307e76641624d4a378a4ddfbfda40b9

    SHA1

    17b9c5175aa7881feac0f72e4deb116b9d55d1c2

    SHA256

    e704295700fa7a8732515ef49fa6bc47397fc919a329b9c080d42e8eda35906f

    SHA512

    f5137f6075c6754a64f5958688b152a9d277f2225cdcf5bd43b4fa227212018d12db8713d099b086b36c8386986646d1b30d3eb295d7d82f84f514e2310db183

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    c1cb615af23380577b8407d283d5be06

    SHA1

    dae3efe38198f0d4527872dd61144759a35f2cca

    SHA256

    cac5918d1485fb979865ead49e8c1f862b2a16ce7b287c23d795ccf5549a4559

    SHA512

    ed22ad5cfd482797fc74b09073b168f03e63ae3718857028e244752c3333d953342abb126455bf75d1792b6bf25cb3ef408cd30345089ac38c8f7a68d0ad81d3

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133812373428458278.txt
    Filesize

    75KB

    MD5

    5fc65609886e3f06569ea1e1fdbd3e3c

    SHA1

    0ac635613cc0ece7709ae15173b1187cb7bddb7a

    SHA256

    3f5101895797ad1b84f22980282e151fc4e07f0016d8b071a4cc27de7861c433

    SHA512

    0f283a70d27118b77d9aa11cb72355340ba6dac78f4a33f7283d1ce822bb2507c9a15507253adb0f747ae18052cf8c5e51403c7a2b1051154c9267f71342c387

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YCLWQ4BV\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    781c2d6d1f6f2f8ae243c569925a6c44

    SHA1

    6d5d26acc2002f5a507bd517051095a97501931b

    SHA256

    70687e419879f006d0c50c08657c66b1187b94ea216cfe0a2e6be8bd2de77bc8

    SHA512

    3599fa8f2ffe140a8f68ec735810d24a5b367a9a551d620baa6dc611ca755dce1a662bf22b90f842d499d2c9530fb8acd634d1654d5e2c1b319574cbf35eadf7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7D75D\D57E.D75
    Filesize

    996B

    MD5

    26d59c59cb1cedba679fd8eb267a9910

    SHA1

    7713ff9a741bd79af96331ce76fb512757825bb3

    SHA256

    f3c3f51c46586126abdc511630f74ac54017147886a634e460c8e51cd41d92b0

    SHA512

    99bb3194fff0f788a03143fdf2cf43173cc53a1dc7106aebcd589936463ac802e46c546320e0fffdb27a49a478cd7cc38e107712bd25f5f347e1a5c343658ecf

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7D75D\D57E.D75
    Filesize

    1KB

    MD5

    d58fb35b380745f87e2d2d1ca08af335

    SHA1

    6fa12daa52ef2191449719795ff38ff6e1b4e951

    SHA256

    54e693f5924fbd85c9ce48102bec93b608c41814b0d3ed8dbe782d7eaeb01d62

    SHA512

    ce81d4852c7eaea47485f7c5311d42b67dd6a67cfa59fbb7ea7e3d8a793e49201bc682a5c659c4650f0de0b0c31a718865d121d7df9764a51c7b7936612ef261

    Download Submit

  • C:\Users\Admin\AppData\Roaming\7D75D\D57E.D75
    Filesize

    600B

    MD5

    4a7b8da6dd61b6ef9b9db5c9696cc489

    SHA1

    88829ef48d9875e54c4828126cfc86e456af82e5

    SHA256

    d93e45b3cb6cf8fe4104faa1a8534ffccf54712fd3d7b20b4b2144a4edc1f76d

    SHA512

    4575f805388e61ebb2481dcc2368665b41671aa2aef563cb43d2ea9e2d5615c8b2682f48f8a4828141fe7f4e5d3c53bfa4751032e665cc0cde6925ba4cac38c6

    Download Submit

  • C:\Users\Admin\DV245F.exe
    Filesize

    216KB

    MD5

    00b1af88e176b5fdb1b82a38cfdce35b

    SHA1

    c0f77262df92698911e0ac2f7774e93fc6b06280

    SHA256

    50f026d57fea9c00d49629484442ea59cccc0053d7db73168d68544a3bbf6f59

    SHA512

    9e55e7c440af901f9c6d0cdae619f6e964b9b75c9351c76ea64362ff161c150b12a1caabb3d2eb63353a59ae70e7159ca6b3793ed0cc11994766846ac316107f

    Download Submit

  • C:\Users\Admin\aohost.exe
    Filesize

    152KB

    MD5

    4401958b004eb197d4f0c0aaccee9a18

    SHA1

    50e600f7c5c918145c5a270b472b114faa72a971

    SHA256

    4c477ed134bc76fa7b912f1aad5e59d4f56f993baa16646e25fec2fdeed3bd8b

    SHA512

    f0548bdaafce2cde2f9d3bd1c26ed3c8e9321ef6d706bd372e18886d834828e5bb54ae44f19764e94574ceb4a1a2a99bdd8476e174b05114fcac9a6d4a2d58e6

    Download Submit

  • C:\Users\Admin\bohost.exe
    Filesize

    173KB

    MD5

    0578a41258df62b7b4320ceaafedde53

    SHA1

    50e7c0b00f8f1e5355423893f10ae8ee844d70f4

    SHA256

    18941e3030ef70437a5330e4689ec262f887f6f6f1da1cd66c0cbae2a76e75bf

    SHA512

    5870a73798bad1f92b4d79f20bf618112ec8917574f6b25ab968c47afff419a829eef57b0282fb4c53e6e636436c8cf52a01426c46bdd4a0ea948d371f0feb09

    Download Submit

  • C:\Users\Admin\dohost.exe
    Filesize

    24KB

    MD5

    d7390e209a42ea46d9cbfc5177b8324e

    SHA1

    eff57330de49be19d2514dd08e614afc97b061d2

    SHA256

    d2d49c37bdf2313756897245c3050494b39e824af448450eca1c0e83cf95b1e5

    SHA512

    de0eb11dd20cd9d74f47b138fb4189a299a57173fe2635150045b01629354f35b26e0575acd25501403af0db238a123b2e5a79582b47aee1d6e786f5eec1929d

    Download Submit

  • C:\Users\Admin\huomuz.exe
    Filesize

    216KB

    MD5

    104f6532a3266206d36e8e133fd6b777

    SHA1

    6a6f2ab08b554f2404b73157eeafc5d88c2267b1

    SHA256

    8c46da8c6e835c1d9709db4d7c2f3c3f10be60d32871ae1eb95057fca80448f1

    SHA512

    ab72460c190803e05a80b43c20c4aff4cd81d4d576da486579b9ae4e077c51f1d7bcea0b8d2f2663f47b623da742d2bbf673b857d0f70124ec018cd4223d6e5c

    Download Submit

  • memory/556-571-0x000001318B660000-0x000001318B680000-memory.dmp

    Filesize

    128KB

    Download

  • memory/556-598-0x000001318BA20000-0x000001318BA40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/556-584-0x000001318B620000-0x000001318B640000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1048-713-0x000001E3AA9E0000-0x000001E3AAAE0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1048-748-0x000001EBACF10000-0x000001EBACF30000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1048-726-0x000001EBACB00000-0x000001EBACB20000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1048-717-0x000001EBACB40000-0x000001EBACB60000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1048-712-0x000001E3AA9E0000-0x000001E3AAAE0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1364-69-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/1432-47-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1432-41-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1432-74-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1432-42-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1432-48-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1932-409-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2360-46-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2492-301-0x0000018BD4900000-0x0000018BD4920000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2492-266-0x0000018BD3500000-0x0000018BD3600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2492-267-0x0000018BD3500000-0x0000018BD3600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2492-270-0x0000018BD4330000-0x0000018BD4350000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2492-265-0x0000018BD3500000-0x0000018BD3600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2492-281-0x0000018BD42F0000-0x0000018BD4310000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2612-264-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2736-141-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/3236-252-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/3236-889-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/3236-75-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/3236-143-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/4240-564-0x0000000004040000-0x0000000004041000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4848-261-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-6-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-0-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-1-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-7-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-4-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4848-49-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4916-5-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4996-414-0x0000018CBED70000-0x0000018CBEE70000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4996-413-0x0000018CBED70000-0x0000018CBEE70000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4996-417-0x00000194C0ED0000-0x00000194C0EF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4996-412-0x0000018CBED70000-0x0000018CBEE70000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4996-446-0x00000194C12A0000-0x00000194C12C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4996-429-0x00000194C0E90000-0x00000194C0EB0000-memory.dmp

    Filesize

    128KB

    Download