Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...5b.exe

windows7-x64

10

JaffaCakes...5b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2025, 09:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe

  • Size

    165KB

  • MD5

    8701351287784126d2b6fc00a3f7215b

  • SHA1

    1b8f28a02416d12e485f06b445994c17ecf89fff

  • SHA256

    198bf94a578eb6a3403029983d49bfaec46c5faa07053de40168a6572e9ebf9c

  • SHA512

    f9cd6aa7bc05611c1f2baf2f968be3dca989af33286d40132e3fb16f7c4fcc202ddb254dfe4d4e1b1103cdf20e11271df7f63760259cb745eddaaf02d74d35b2

  • SSDEEP

    3072:snouwXqQPvUubHKBT3D8kH4/xA02cRHwneYifp5rMARkygyNbVGPzYtKrU:EouwXqQPvUuSDH4Jp2OaIRCJtHU

Score
10/10
cycbotbackdoordiscoverypersistenceratupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe startC:\Program Files (x86)\LP\C1B7\7B5.exe%C:\Program Files (x86)\LP\C1B7
      2⤵
        PID:2984
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe startC:\Program Files (x86)\7C05B\lvvm.exe%C:\Program Files (x86)\7C05B
        2⤵
          PID:5028

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        7.98.22.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        7.98.22.2.in-addr.arpa
        IN PTR
        Response
        7.98.22.2.in-addr.arpa
        IN PTR
        a2-22-98-7deploystaticakamaitechnologiescom
      • flag-us
        DNS
        140.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        patentgenius.com
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        8.8.8.8:53
        Request
        patentgenius.com
        IN A
        Response
        patentgenius.com
        IN A
        208.91.197.27
      • flag-us
        GET
        http://patentgenius.com/temp/head.png?sv=112&tq=gwY92w4AGn2fXIUFleWvVF8w7TRzremaL%2B%2BktULUcLZP1dKH5ZCWfkjsv%2B8tMH9VRCvegYij3gmFFd9O7JRUlRjh7gEQzgH6a%2B2SjuEO%2FwDIuRXjU0rxPSiUIARkIxrRN78KeebdbCZfYA%2FOrk41ExKQ9mLxyARiTAqM4uNX0eRTsydXqggot2CcDba%2BaXh1UVmhZoEGxNRsSwZF2xLRxnx%2FClmV
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        208.91.197.27:80
        Request
        GET /temp/head.png?sv=112&tq=gwY92w4AGn2fXIUFleWvVF8w7TRzremaL%2B%2BktULUcLZP1dKH5ZCWfkjsv%2B8tMH9VRCvegYij3gmFFd9O7JRUlRjh7gEQzgH6a%2B2SjuEO%2FwDIuRXjU0rxPSiUIARkIxrRN78KeebdbCZfYA%2FOrk41ExKQ9mLxyARiTAqM4uNX0eRTsydXqggot2CcDba%2BaXh1UVmhZoEGxNRsSwZF2xLRxnx%2FClmV HTTP/1.0
        Connection: close
        Host: patentgenius.com
        Accept: */*
        User-Agent: chrome/9.0
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 17 Jan 2025 09:00:51 GMT
        Server: Apache
        Referrer-Policy: no-referrer-when-downgrade
        Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
        Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
        Content-Length: 302
        Content-Type: text/html; charset=UTF-8
        Connection: close
      • flag-us
        DNS
        27.197.91.208.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        27.197.91.208.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        27.197.91.208.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        27.197.91.208.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        27.197.91.208.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        27.197.91.208.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        -ac8.cloudstorepro.com
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        8.8.8.8:53
        Request
        -ac8.cloudstorepro.com
        IN A
        Response
      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        vis.grizlybigtit.com
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        8.8.8.8:53
        Request
        vis.grizlybigtit.com
        IN A
        Response
      • flag-us
        DNS
        53.210.109.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        53.210.109.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        fohlc-.cloudstorepro.com
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        8.8.8.8:53
        Request
        fohlc-.cloudstorepro.com
        IN A
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        www.google.com
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        8.8.8.8:53
        Request
        www.google.com
        IN A
        Response
        www.google.com
        IN A
        142.250.187.196
      • flag-gb
        GET
        http://www.google.com/
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        142.250.187.196:80
        Request
        GET / HTTP/1.0
        Connection: close
        Host: www.google.com
        Accept: */*
        Response
        HTTP/1.0 302 Found
        Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGP-4qLwGIjCOkfyTHqWIt7GJMRoRipC6lQbaAllh8Fv8TV3GRotNWPmevBnGHfJIElW-vPpbH8QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
        x-hallmonitor-challenge: CgsIgLmovAYQm9rdLBIEtdewUw
        Content-Type: text/html; charset=UTF-8
        Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-PSTdtjEC5WaruisZZkUbnA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
        Date: Fri, 17 Jan 2025 09:01:52 GMT
        Server: gws
        Content-Length: 396
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Set-Cookie: AEC=AZ6Zc-WaNr88SMNfOF93bV0Kn8wvmICgSuaEPt7NJOo01RCT6-MvIjbJhw; expires=Wed, 16-Jul-2025 09:01:52 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
      • flag-gb
        GET
        http://www.google.com/
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        142.250.187.196:80
        Request
        GET / HTTP/1.1
        Connection: close
        Pragma: no-cache
        Host: www.google.com
        Response
        HTTP/1.1 302 Found
        Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGIC5qLwGIjCYsQAaoh4tN9zwHncqIzR8t58yQyi_3EYrAzBPl-xGGvuPWtYJfX9eACN3UXvSww4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
        x-hallmonitor-challenge: CgwIgLmovAYQspCm3wESBLXXsFM
        Content-Type: text/html; charset=UTF-8
        Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-jgrwX-touf_hj1c0QV9kPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
        Date: Fri, 17 Jan 2025 09:01:52 GMT
        Server: gws
        Content-Length: 396
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Set-Cookie: AEC=AZ6Zc-VjCNGUu8ndCqtUfMhwCAvzV-FsYCF_dM5_vA2YDtf-SndMIRQ4104; expires=Wed, 16-Jul-2025 09:01:52 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
        Connection: close
      • flag-us
        DNS
        196.187.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.187.250.142.in-addr.arpa
        IN PTR
        Response
        196.187.250.142.in-addr.arpa
        IN PTR
        lhr25s33-in-f41e100net
      • flag-gb
        GET
        http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGIC5qLwGIjCYsQAaoh4tN9zwHncqIzR8t58yQyi_3EYrAzBPl-xGGvuPWtYJfX9eACN3UXvSww4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        Remote address:
        142.250.187.196:80
        Request
        GET /sorry/index?continue=http://www.google.com/&q=EgS117BTGIC5qLwGIjCYsQAaoh4tN9zwHncqIzR8t58yQyi_3EYrAzBPl-xGGvuPWtYJfX9eACN3UXvSww4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
        Connection: close
        Pragma: no-cache
        Host: www.google.com
        Response
        HTTP/1.1 429 Too Many Requests
        Date: Fri, 17 Jan 2025 09:01:52 GMT
        Pragma: no-cache
        Expires: Fri, 01 Jan 1990 00:00:00 GMT
        Cache-Control: no-store, no-cache, must-revalidate
        Content-Type: text/html
        Server: HTTP server (unknown)
        Content-Length: 3086
        X-XSS-Protection: 0
        Connection: close
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        16.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        16.173.189.20.in-addr.arpa
        IN PTR
        Response
      • 208.91.197.27:80
        http://patentgenius.com/temp/head.png?sv=112&tq=gwY92w4AGn2fXIUFleWvVF8w7TRzremaL%2B%2BktULUcLZP1dKH5ZCWfkjsv%2B8tMH9VRCvegYij3gmFFd9O7JRUlRjh7gEQzgH6a%2B2SjuEO%2FwDIuRXjU0rxPSiUIARkIxrRN78KeebdbCZfYA%2FOrk41ExKQ9mLxyARiTAqM4uNX0eRTsydXqggot2CcDba%2BaXh1UVmhZoEGxNRsSwZF2xLRxnx%2FClmV
        http
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        588 B
         1.1kB
         5
        4

        HTTP Request

        GET http://patentgenius.com/temp/head.png?sv=112&tq=gwY92w4AGn2fXIUFleWvVF8w7TRzremaL%2B%2BktULUcLZP1dKH5ZCWfkjsv%2B8tMH9VRCvegYij3gmFFd9O7JRUlRjh7gEQzgH6a%2B2SjuEO%2FwDIuRXjU0rxPSiUIARkIxrRN78KeebdbCZfYA%2FOrk41ExKQ9mLxyARiTAqM4uNX0eRTsydXqggot2CcDba%2BaXh1UVmhZoEGxNRsSwZF2xLRxnx%2FClmV

        HTTP Response

        403
      • 127.0.0.1:53455
      • 142.250.187.196:80
        http://www.google.com/
        http
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        302 B
         1.5kB
         5
        5

        HTTP Request

        GET http://www.google.com/

        HTTP Response

        302
      • 142.250.187.196:80
        http://www.google.com/
        http
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        307 B
         1.5kB
         5
        5

        HTTP Request

        GET http://www.google.com/

        HTTP Response

        302
      • 142.250.187.196:80
        http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGIC5qLwGIjCYsQAaoh4tN9zwHncqIzR8t58yQyi_3EYrAzBPl-xGGvuPWtYJfX9eACN3UXvSww4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
        http
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        526 B
         3.7kB
         6
        7

        HTTP Request

        GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGIC5qLwGIjCYsQAaoh4tN9zwHncqIzR8t58yQyi_3EYrAzBPl-xGGvuPWtYJfX9eACN3UXvSww4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

        HTTP Response

        429
      • 127.0.0.1:53455
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
      • 127.0.0.1:53455
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
      • 127.0.0.1:53455
      • 127.0.0.1:53455
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        140.32.126.40.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        140.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        7.98.22.2.in-addr.arpa
        dns
        68 B
         129 B
         1
        1

        DNS Request

        7.98.22.2.in-addr.arpa

      • 8.8.8.8:53
        patentgenius.com
        dns
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        62 B
         78 B
         1
        1

        DNS Request

        patentgenius.com

        DNS Response

        208.91.197.27

      • 224.0.0.251:5353
        168 B
         3
      • 8.8.8.8:53
        27.197.91.208.in-addr.arpa
        dns
        216 B
         216 B
         3
        3

        DNS Request

        27.197.91.208.in-addr.arpa

        DNS Request

        27.197.91.208.in-addr.arpa

        DNS Request

        27.197.91.208.in-addr.arpa

      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        -ac8.cloudstorepro.com
        dns
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        68 B
         141 B
         1
        1

        DNS Request

        -ac8.cloudstorepro.com

      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        vis.grizlybigtit.com
        dns
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        66 B
         139 B
         1
        1

        DNS Request

        vis.grizlybigtit.com

      • 8.8.8.8:53
        53.210.109.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        53.210.109.20.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        fohlc-.cloudstorepro.com
        dns
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        70 B
         143 B
         1
        1

        DNS Request

        fohlc-.cloudstorepro.com

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        www.google.com
        dns
        JaffaCakes118_8701351287784126d2b6fc00a3f7215b.exe
        60 B
         76 B
         1
        1

        DNS Request

        www.google.com

        DNS Response

        142.250.187.196

      • 8.8.8.8:53
        196.187.250.142.in-addr.arpa
        dns
        74 B
         112 B
         1
        1

        DNS Request

        196.187.250.142.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        16.173.189.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        16.173.189.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\73C7C\C05B.3C7
        Filesize

        996B

        MD5

        142182b9122df2d69be710d1aedc07b8

        SHA1

        6a9222dbdc4d49451e8da022313673057c47216d

        SHA256

        ba37b12270d2fa80a7ba31ceff09a08ab710707ee1b25b4db8c14a1ac61e6e64

        SHA512

        fb5a64a052e728cf5f4d6c7fa4cd41e5a467b5a680ad5073957f6e182374f68d6a8fa1c0151c4a16add76577be13118470d45cc6aefb7323164d66b069399f77

        Download Submit

      • C:\Users\Admin\AppData\Roaming\73C7C\C05B.3C7
        Filesize

        600B

        MD5

        91d46e9585f00f0523c92a0552583c7f

        SHA1

        d8cadc7a0707d264d1dd4444e035bb26f577dbef

        SHA256

        083cf51828c991462c56519fdf8929423c74b94471393cad81a170e7525b6dbb

        SHA512

        274a5fb912eced85de765c352c0e566ea5d34069ffbb953746a85d0b7fd78a207c4af7d42a869076cdd492fe946c3f26deaa752a7edc8554e4966eaf329a0905

        Download Submit

      • C:\Users\Admin\AppData\Roaming\73C7C\C05B.3C7
        Filesize

        1KB

        MD5

        050843f383606569f20d2caf4c553cd3

        SHA1

        3a6c71b0a2458c574b8f867e73267cdca4a93430

        SHA256

        ca1c3712b2c857b30d3d3a2c6a4b0d8281bf69112ea1b2c3fa4c906a9855cea1

        SHA512

        b34558a0569228ad6faa70adea07b3e23d8961197f6b6fa8c09fe8ac635cdcf9e1d4479ac06c63cf91899a9ae25192c91e8ce205b052839965e2f44a1f7f107a

        Download Submit

      • memory/1460-117-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1460-16-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1460-17-0x0000000000400000-0x000000000048E000-memory.dmp

        Filesize

        568KB

        Download

      • memory/1460-0-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1460-3-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1460-2-0x0000000000400000-0x000000000048E000-memory.dmp

        Filesize

        568KB

        Download

      • memory/1460-255-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/2984-15-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/2984-14-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/5028-116-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.