Overview

overview

10

Static

static

3

JaffaCakes...18.exe

windows7-x64

10

JaffaCakes...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2025 17:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_fa05264100e8f110940bb4132f9f9e18.exe

  • Size

    267KB

  • MD5

    fa05264100e8f110940bb4132f9f9e18

  • SHA1

    0f286ebd4a48a0f68b0de52f93329807d869777d

  • SHA256

    d160e6c91029935be6e1c62c7942b8fdd178b11b7525ef7f9965addcf9a82d97

  • SHA512

    a26c536e492696af45abd63f5cfd62beac1cc7b56c757ea44860f5d076bf0af66b509a2794c8a14a1d1b5efa0b2771e62aac5cd40b954d18326a7b679d9d89e4

  • SSDEEP

    6144:A9+j1NrPtqmhLOXg83y2WC3d1uf5vQiZKD1dxp/s4:AYllzhLOXr3vW2MfpJZKVpB

Score
10/10
simdaadwarediscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa05264100e8f110940bb4132f9f9e18.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa05264100e8f110940bb4132f9f9e18.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2052
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjlDQUVGODktQkU0Ri00RkZFLTk4REQtQUQ0OTc4OUUzMEI0fSIgdXNlcmlkPSJ7N0NEMEM4RjItMjdBRi00MzAyLTgwQTctOEEzMjE5QUI3MjAyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUI3MTExQjUtMTFFMi00MEFELUFCNjYtRTdFQ0Q0NUYyNjU2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI3IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODQzNzk4ODIzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3020
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4424
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff68fb46a68,0x7ff68fb46a74,0x7ff68fb46a80
        3⤵
        • Executes dropped EXE
        PID:3680
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:980
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff68fb46a68,0x7ff68fb46a74,0x7ff68fb46a80
          4⤵
          • Executes dropped EXE
          PID:4124
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff70d576a68,0x7ff70d576a74,0x7ff70d576a80
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:3384
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff70d576a68,0x7ff70d576a74,0x7ff70d576a80
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2188
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff70d576a68,0x7ff70d576a74,0x7ff70d576a80
          4⤵
          • Executes dropped EXE
          PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

7
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A52E3A86-F096-4ECE-91FF-E9B114A82D81}\EDGEMITMP_B7CF3.tmp\setup.exe
    Filesize

    6.8MB

    MD5

    1b3e9c59f9c7a134ec630ada1eb76a39

    SHA1

    a7e831d392e99f3d37847dcc561dd2e017065439

    SHA256

    ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

    SHA512

    c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

    Download Submit

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    Filesize

    3.9MB

    MD5

    ad5f7dc7ca3e67dce70c0a89c04519e0

    SHA1

    a10b03234627ca8f3f8034cd5637cda1b8246d83

    SHA256

    663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

    SHA512

    ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

    Download Submit

  • C:\Program Files\msedge_installer.log
    Filesize

    73KB

    MD5

    2b36ae1d0b7ace0324e3bd2ed80e8c2b

    SHA1

    0d06a7f806aee5e62c2807bc50fc4817b20beb5a

    SHA256

    1489344bbb7529f0052d65429784d9d0000c94e736a8ecdf16db97aae1196045

    SHA512

    ee0d74d5d256273281bb45e4b1d3d00c3c1f98efc78f588f6f4b3ef74483a4f6b27abc7bcb20042ae01e827d85568561c9b17b98ba73dcac79d5eb713467aeb9

    Download Submit

  • C:\Program Files\msedge_installer.log
    Filesize

    98KB

    MD5

    cc1420597437872d9fc3ed581a346f72

    SHA1

    61edb09b270027395f96e9db85da01f41864e957

    SHA256

    ce0281f67d1f64fad0cb725fd2b78c8885a01553647486e8bbdbe2f559a06103

    SHA512

    86011752486d2524e84d2b9b699a5486aa7b86705014450698b9f97d06a41a1f0b288ec5bb68472ccaae5f23de1777e09a7ee534f908b1673d5db207ecbd11ad

    Download Submit

  • C:\Program Files\msedge_installer.log
    Filesize

    99KB

    MD5

    8a66241a2c2913fcbf833d4e9565d889

    SHA1

    4fd0763ca8644e3433713a74b65f3ed0d0daffe5

    SHA256

    e27eeb06fad406c50d47fc553c90fc10258c082aa10bab01f0810d1181ea0904

    SHA512

    4c32fe8c25d4308288d6107f6118d200d206acf92254467b3284ee7fc0acde42d017861895ddecbaa26c01a2da27e7b86a90a2e9f43b057251b2e69644758306

    Download Submit

  • C:\Program Files\msedge_installer.log
    Filesize

    104KB

    MD5

    c76676ba61f104e24e6b38d654c7a7cf

    SHA1

    95c6d07a668a73def7db1bc1c0923fb4ef48e757

    SHA256

    57e41f5a56dee9bfe3a5b040f08e5bb2f153adbd59981197655ae5b5b538bf1e

    SHA512

    d7b97c508eec891290c3fae7c2e7c6b7120a724182df311ccdae0d974a57a2b7c51df91f79c321702553a3e4bb66cfaff4024ee7ae771c4670eca70dd96734c2

    Download Submit

  • memory/2052-96-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-114-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-4-0x0000000000BD0000-0x0000000000C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2052-5-0x0000000000400000-0x00000000006A8000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2052-6-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-8-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-11-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-72-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-75-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-118-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-117-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-116-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-115-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-92-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-113-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-112-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-110-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-109-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-108-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-107-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-106-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-105-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-104-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-103-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-102-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-101-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-100-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-98-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-97-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-2-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

    Download

  • memory/2052-90-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-94-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-87-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-3-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2052-95-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-89-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-88-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-93-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-86-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-85-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-84-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-81-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-82-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-80-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-79-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-78-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-77-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-76-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-74-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-73-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-71-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-70-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-69-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-68-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-66-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-65-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-111-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-99-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-91-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-1-0x0000000000850000-0x000000000089F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2052-0-0x0000000000400000-0x00000000006A8000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2052-83-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-67-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-64-0x0000000002A00000-0x0000000002AB8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2052-129-0x0000000000850000-0x000000000089F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2052-131-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

    Download