Overview

overview

10

Static

static

5

JaffaCakes...cc.exe

windows7-x64

10

JaffaCakes...cc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-02-2025 19:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_e983e7b9e6d848397029c2b2d73b7fcc.exe

  • Size

    257KB

  • MD5

    e983e7b9e6d848397029c2b2d73b7fcc

  • SHA1

    b0f257d55001ae86c8032a9f9cac8612377c91c4

  • SHA256

    c48bfce49ba64436860fc58a821d165a6696ae76dbcf409a986119a94d0d6688

  • SHA512

    c67285178adbb2fe92509c7e778e1bbb224a3a0885975a0f55a0ac3de34a4c124fce69a129b569d9521680fca1a5f5cd4ba65304239b977942817b84ae83be0b

  • SSDEEP

    6144:dgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:n9C3N2ZIUl4/njr8B2Yz

Score
10/10
simdaadwarediscoverypersistenceprivilege_escalationstealertrojanupx

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e983e7b9e6d848397029c2b2d73b7fcc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e983e7b9e6d848397029c2b2d73b7fcc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3952
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkNBMUIyNjQtOEQzNS00NEE4LTk1MkYtMTlGMDJDNzBDOUJCfSIgdXNlcmlkPSJ7M0E5QzVCRUItRjg1MC00Q0Y4LTkzMzktQUMwOTA1QTdBQzUyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Qjg5ODVCMkUtNUE4Mi00MUUwLUFGNUItMUJDRjYyOTQ2QkI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjkxNDE5MTE3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3956
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3184
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6ddb6a818,0x7ff6ddb6a824,0x7ff6ddb6a830
        3⤵
        • Executes dropped EXE
        PID:4492
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6ddb6a818,0x7ff6ddb6a824,0x7ff6ddb6a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:5104
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6eb1ba818,0x7ff6eb1ba824,0x7ff6eb1ba830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2376
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6eb1ba818,0x7ff6eb1ba824,0x7ff6eb1ba830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:3296
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6eb1ba818,0x7ff6eb1ba824,0x7ff6eb1ba830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:3128
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:4744
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
        PID:3928
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3444

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Browser Extensions

      1
      T1176

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Privilege Escalation

      Boot or Logon Autostart Execution

      4
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Event Triggered Execution

      1
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Defense Evasion

      Modify Registry

      7
      T1112

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F894C887-2956-4469-9BB9-5B78EA625A4F}\EDGEMITMP_74DB6.tmp\setup.exe
        Filesize

        6.6MB

        MD5

        b4c8ad75087b8634d4f04dc6f92da9aa

        SHA1

        7efaa2472521c79d58c4ef18a258cc573704fb5d

        SHA256

        522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

        SHA512

        5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

        Download Submit

      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        Filesize

        3.7MB

        MD5

        3646786aea064c0845f5bb1b8e976985

        SHA1

        a31ba2d2192898d4c0a01511395bdf87b0e53873

        SHA256

        a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

        SHA512

        145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        70KB

        MD5

        2ec84276fe5e08eefa22162fa7e0f79e

        SHA1

        41a287c7e75d24a057475dad76acc5ad075457b7

        SHA256

        8580c5f6c575bf44f1e1ed3b14a69e0776c7ad8bc412a05b4d59fd80020b708b

        SHA512

        810fe457f7b5110f640cc1e5f3d1efd3ffbbe7947c32965eb16450a6da0be48302b4d16fc18454b0e5abb83bf1a2d5c30295a425becc900773191081930e3a56

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        96KB

        MD5

        050a88ce9f3798e4dc00a9e13d836df2

        SHA1

        a24bfec953dbadf2efbc53a83b3229c0f7b0b4a3

        SHA256

        eb0b1be373a50207b619910b3b3d4fc6686a7347812524ee0e59e87e2b34a424

        SHA512

        87341c1d2b9ab5d72397d5c3211484a6355b387dd8ddbc1f554e7ecbcec3a47fe113076ffe0affdd920e3948e69c11e2c7023108aae446e289711c6e242914cf

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        97KB

        MD5

        16608754cd3f42033aaa50bf37202da8

        SHA1

        f169c55d8e4b9a62c18f72ba0034bba7e0bf63d7

        SHA256

        b9592529aca36835764cfa73aca71f1bb92b040509fd577176aaa9742d1ce769

        SHA512

        c2d38f6828845ccd8bc5ce59d7a8f361dc40490292d8b2e6570d90c6a2551ed764acf4f63505f0428512a2f88cd9e1525d2d12fe9184d352d75c3e2e91d8eead

        Download Submit

      • C:\Program Files\msedge_installer.log
        Filesize

        102KB

        MD5

        bd3e30b0bfdfa644b63ffa4a50cf4e14

        SHA1

        7d991cf9bbb6ef4c164244ba94439843c6cf5d7b

        SHA256

        fc4f93f4338cca10dc3bda2e75b6fa45f7443d0e32754f776bc79c3a332ea3e2

        SHA512

        d400ea26645c4fa4cc2e1f4ea892f83db912f0040a95c1d88a54ffcf85313a27552d9df99a346183687537aeea220fb241d92b33b3d081cabdd927d5de40a9b6

        Download Submit

      • memory/3928-256-0x000001DE67340000-0x000001DE67589000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/3928-255-0x000001DE4BF90000-0x000001DE4BF98000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3928-254-0x000001DE4BF60000-0x000001DE4BF6A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3928-253-0x000001DE4BAB0000-0x000001DE4BABE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/3952-89-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-82-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-65-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-74-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-113-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-112-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-111-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-110-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-109-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-108-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-107-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-105-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-104-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-103-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-102-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-101-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-100-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-99-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-98-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-97-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-96-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-95-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-87-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-94-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-92-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-91-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-90-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-10-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-88-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-86-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-85-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-84-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-83-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-8-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-81-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-79-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-78-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-77-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-75-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-73-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-72-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-71-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-70-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-69-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-68-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-67-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-66-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-64-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-63-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-62-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-106-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-61-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-93-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-60-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-59-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-6-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-5-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/3952-4-0x0000000002340000-0x00000000023F2000-memory.dmp

        Filesize

        712KB

        Download

      • memory/3952-2-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download

      • memory/3952-1-0x0000000000690000-0x00000000006D7000-memory.dmp

        Filesize

        284KB

        Download

      • memory/3952-0-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/3952-80-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-58-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-76-0x00000000028E0000-0x0000000002998000-memory.dmp

        Filesize

        736KB

        Download

      • memory/3952-126-0x0000000000690000-0x00000000006D7000-memory.dmp

        Filesize

        284KB

        Download

      • memory/3952-131-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

        Download