Overview

overview

10

Static

static

3

JaffaCakes...fb.exe

windows7-x64

10

JaffaCakes...fb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-02-2025 23:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_eb4e717e4120b2df5f6c8cd6641264fb.exe

  • Size

    281KB

  • MD5

    eb4e717e4120b2df5f6c8cd6641264fb

  • SHA1

    2dd0541b46f229e37164991834252e07cf58f66f

  • SHA256

    94e6bce2a2bf54658129161c0b046c658242eba69682f0347dde4926195739dc

  • SHA512

    13c2b6da084122bce6bdeeb273cc58fa24e518c1fec67368ce908b99899b2320559557c5f9032e571328ae80b58f2816c7942e53dca15ea589d11438f305a502

  • SSDEEP

    6144:9pcnH1hymlUEAsvK7ke5L3iFPwsj9CnL9R6jbKVCA7W5f1uHVOJ:9pYDycUEAWK7SCsj9kLnCAS9IVW

Score
10/10
simdaadwarediscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb4e717e4120b2df5f6c8cd6641264fb.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb4e717e4120b2df5f6c8cd6641264fb.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3652
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUFGQ0E3OTYtODFDRC00NjBDLTk0NTItM0M2OTdEOTc1MkU1fSIgdXNlcmlkPSJ7N0RDNzQ2NDctMEE1Qi00NkY3LTlEOTAtNEY1Qzg4MTBBNzU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTYwNjBCNTAtOEQyNS00NTE0LUEyMEEtOTQ5Rjg2OThCQ0QzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTc3OTc0ODM4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4384
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3756
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff65db96a68,0x7ff65db96a74,0x7ff65db96a80
        3⤵
        • Executes dropped EXE
        PID:4636
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff65db96a68,0x7ff65db96a74,0x7ff65db96a80
          4⤵
          • Executes dropped EXE
          PID:968
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6e5f16a68,0x7ff6e5f16a74,0x7ff6e5f16a80
          4⤵
          • Executes dropped EXE
          PID:2748
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6e5f16a68,0x7ff6e5f16a74,0x7ff6e5f16a80
          4⤵
          • Executes dropped EXE
          PID:1860
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6e5f16a68,0x7ff6e5f16a74,0x7ff6e5f16a80
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1208
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:3548
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
        PID:4360
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2360

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Browser Extensions

      1
      T1176

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Privilege Escalation

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Defense Evasion

      Modify Registry

      7
      T1112

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B838DA9C-F3CE-491C-8C65-58BE3E1309E0}\EDGEMITMP_9538A.tmp\setup.exe
        Filesize

        6.8MB

        MD5

        1b3e9c59f9c7a134ec630ada1eb76a39

        SHA1

        a7e831d392e99f3d37847dcc561dd2e017065439

        SHA256

        ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

        SHA512

        c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

        Download Submit

      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        Filesize

        3.9MB

        MD5

        ad5f7dc7ca3e67dce70c0a89c04519e0

        SHA1

        a10b03234627ca8f3f8034cd5637cda1b8246d83

        SHA256

        663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

        SHA512

        ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        73KB

        MD5

        2802cc6351f392704dfc809bfb7228a6

        SHA1

        2cf8ff2d931ac69b14db8a8540acf63933ecc80e

        SHA256

        98586847cdc55c8ff377e3a0ef098a65b36256c4412128da85beeef07ad89d7c

        SHA512

        d5b126f8e48789cba976e4c0675d5c8f41ec3539d0dfa1082b9675c94eac34c2ab68e39ac7010407f04dfa00a656d80921fab89e7952ddf299be37e157c282cd

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        101KB

        MD5

        6f5db39b3d1222447a61a1c1b0ee90f2

        SHA1

        c9b55d51254e96dc1bbc80ffc581116f45245e58

        SHA256

        6b90769ac79452f87040b3ac4e8115d9e729b454a6c3963b31f6642de4ab0e6e

        SHA512

        0e2b48ac2618837288a3a14e0de1e8ed515c42812170f6dae983e23d95455ac6f31b4824556670b51583f1695675f212705cbe14517d7711be99cf9275b74ebf

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        103KB

        MD5

        0040b3193103eced69e7515909cee76e

        SHA1

        b55108044bd448c74718f41bbb114b2845399aca

        SHA256

        cfdc2774e46e886799501829b734c8ae82048825244be2821d7aa0d77d39a624

        SHA512

        343e5476f47dae5e20846866e856a04e5415e25dd3aa58252c6593ededd3f4b79bc57cf3cb555ff4d269398c45c0ce98bc7762c25d5c0a4a07bdf3678bc2479c

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        105KB

        MD5

        ee7e08c66a23cd431a2f9e144b909215

        SHA1

        26c63c1459bf3b48e013b6800c1bea4bd4fa86fd

        SHA256

        a93e83e9cb4579f705726eb4a2ed4956df3c3f873c491e17168c2e601e738afc

        SHA512

        5d7c4a28f53f9c2fda0abdd024fed813e1d57a7881ebbc9c85d1d7b91199b4a38f1cab8c0be6007ccef19db3f05f2fabea61f66abd7983260c79163ec37d54d8

        Download Submit

      • memory/3652-79-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-8-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-5-0x0000000000400000-0x000000000068D000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/3652-6-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-10-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-74-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-72-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-75-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-114-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-112-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-73-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-109-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-107-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-105-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-103-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-101-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-100-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-99-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-97-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-95-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-94-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-92-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-91-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-89-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-88-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-86-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-85-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-83-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-82-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-76-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-80-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-2-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download

      • memory/3652-78-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-77-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-81-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-4-0x0000000002550000-0x0000000002602000-memory.dmp

        Filesize

        712KB

        Download

      • memory/3652-111-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-71-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-70-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-69-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-68-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-66-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-65-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-64-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-63-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-62-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-113-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-110-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-108-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-106-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-104-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-102-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-61-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-98-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-96-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-93-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-60-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-90-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-87-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-1-0x0000000000CA0000-0x0000000000CEF000-memory.dmp

        Filesize

        316KB

        Download

      • memory/3652-0-0x0000000000400000-0x000000000068D000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/3652-84-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-59-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-67-0x0000000002610000-0x00000000026C8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3652-124-0x0000000000CA0000-0x0000000000CEF000-memory.dmp

        Filesize

        316KB

        Download

      • memory/3652-130-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download

      • memory/4360-281-0x00000156857D0000-0x00000156857DE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4360-282-0x000001569FCE0000-0x000001569FCEA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4360-283-0x000001569FD10000-0x000001569FD18000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4360-284-0x00000156A1000000-0x00000156A1249000-memory.dmp

        Filesize

        2.3MB

        Download