Overview

overview

10

Static

static

3

JaffaCakes...70.exe

windows7-x64

10

JaffaCakes...70.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/02/2025, 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_dc03c5e99a1040f3e9767c6738d35370.exe

  • Size

    263KB

  • MD5

    dc03c5e99a1040f3e9767c6738d35370

  • SHA1

    d2d2ac085aefe0b176d43efaa9032893a39c56bc

  • SHA256

    943a366b83b477809d0f50484d7e2db5c7623f2cf82326f83fe3ce5cde41734a

  • SHA512

    a9db17b9d5565c4b2c81a7a4bab410ea4e243aacdfa842212e3730a7f0e90cd041741485c75ab1f856cf82eff622ab4720f627c940f47345fb9431ba4637ead5

  • SSDEEP

    6144:PhPZy+chYf9vFAQewiHStKoOZ3j7BAkQd/b+TGCokrArDP6c:/Bf9FLlpOJxQdjlD7

Score
10/10
simdaadwarediscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc03c5e99a1040f3e9767c6738d35370.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc03c5e99a1040f3e9767c6738d35370.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3968
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTBENDYwMTAtRUMwQy00NzVDLUE3NDYtRDI2MDNERTBGODhGfSIgdXNlcmlkPSJ7MzJCNTU5MEEtOUYyNC00QjIwLTlDRjgtNTRFRjc1RTIyOTI5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjBERkJFMTAtQzA1Qi00Q0E2LUEzOEUtMTc1N0QyNjEyMEZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTMyNTc2MjU1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:1088
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3360
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63c8aa818,0x7ff63c8aa824,0x7ff63c8aa830
        3⤵
        • Executes dropped EXE
        PID:4708
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63c8aa818,0x7ff63c8aa824,0x7ff63c8aa830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2720
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff67956a818,0x7ff67956a824,0x7ff67956a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:3020
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff67956a818,0x7ff67956a824,0x7ff67956a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1068
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff67956a818,0x7ff67956a824,0x7ff67956a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2080
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:2232
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
        PID:3076
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:932

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Browser Extensions

      1
      T1176

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Privilege Escalation

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Defense Evasion

      Modify Registry

      7
      T1112

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CE5E803-7888-462F-A8B9-C9A89DAF8C58}\EDGEMITMP_E104E.tmp\setup.exe
        Filesize

        6.6MB

        MD5

        b4c8ad75087b8634d4f04dc6f92da9aa

        SHA1

        7efaa2472521c79d58c4ef18a258cc573704fb5d

        SHA256

        522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

        SHA512

        5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

        Download Submit

      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        Filesize

        3.7MB

        MD5

        3646786aea064c0845f5bb1b8e976985

        SHA1

        a31ba2d2192898d4c0a01511395bdf87b0e53873

        SHA256

        a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

        SHA512

        145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        70KB

        MD5

        a03777471b1170b3037c0b2f6bcb695b

        SHA1

        0c9e947a5c542e23311bedd8a030ed7870b5ecc3

        SHA256

        f70b4c0f01370edab05191f96440e2efed640c61ac7830f823f09e53dd424153

        SHA512

        ae8ec8263a8c994fbdd8983f2a6e2bcfaf66959e6dfe22d4a5e7c9abfe59d7e7c9863c524dc003f5cef81e171b5ff3c54746bc9e0c55e0c47d4d4a9c88aa7234

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        96KB

        MD5

        54e8381db4fcb0b486705ae9349fde42

        SHA1

        87f0d777daf3b171e315ebefa12f55761511705e

        SHA256

        65011fd103b5bfa4a63ccb93231eef8838f76fc1e4296b4c4a588446d7041eec

        SHA512

        2be50f81c63105ea2c365305efc2b5e2668b2ed5d980c3885f7576fa5768eb14b596ef322cf4f97cbf1b5a4f4a386158a282379b2bcee01ab92bb765943ad470

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        96KB

        MD5

        6fc2ed525656fc9d623c8ef6dd9467aa

        SHA1

        fac1762c7d34ab5d03e3395db38a2b5d710d6b12

        SHA256

        99a8ca530d1a98e10a32884b5b9106bfd9b01624cc3b526b05588bd59c59247a

        SHA512

        9f5df1538c4d269c697b73f26d5e8535d0b37e2560ed4b55d0ae760e5a93e92c540f8f203367148b10e632afcf6136b6dfe270f0348060dbd20e1721465d011f

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        102KB

        MD5

        46810422183cd7d69c873d2d3ddc0719

        SHA1

        ada610a617517fb029b92a9503a28e50a72f54ec

        SHA256

        d2e058d580442b694628c74b0031ab306d4e46ca203c35bc318888a6ce05da98

        SHA512

        6784b95039a83b5e0c115571420d73618eb1a98b4d32d5a6e1d32796465f167250abf2916171908a6b22f7a2ecc4d1de4af4d0a7edfc96c67acc2b986f07379a

        Download Submit

      • memory/3076-337-0x0000025F80A00000-0x0000025F80C49000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/3076-336-0x0000025FFFFA0000-0x0000025FFFFA8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3076-335-0x0000025FE65D0000-0x0000025FE65DA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3076-334-0x0000025FE6150000-0x0000025FE615E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/3968-94-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-87-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-67-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-73-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-118-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-117-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-116-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-115-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-114-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-113-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-112-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-111-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-110-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-109-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-108-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-107-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-106-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-104-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-103-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-102-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-101-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-100-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-99-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-98-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-97-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-96-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-95-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-9-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-93-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-92-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-91-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-90-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-89-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-7-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-86-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-85-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-84-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-83-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-82-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-81-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-80-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-78-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-77-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-76-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-75-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-74-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-72-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-71-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-70-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-69-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-68-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-66-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-105-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-65-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-64-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-5-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-4-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

        Download

      • memory/3968-3-0x0000000002360000-0x0000000002412000-memory.dmp

        Filesize

        712KB

        Download

      • memory/3968-2-0x0000000000760000-0x0000000000761000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3968-1-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download

      • memory/3968-0-0x000000007FDE0000-0x000000007FE49000-memory.dmp

        Filesize

        420KB

        Download

      • memory/3968-88-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-63-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-79-0x0000000002910000-0x00000000029C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3968-127-0x000000007FDE0000-0x000000007FE49000-memory.dmp

        Filesize

        420KB

        Download

      • memory/3968-130-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download