Overview

overview

10

Static

static

52e13c80fd...1e.exe

windows7-x64

10

52e13c80fd...1e.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2022 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e.exe

  • Size

    325KB

  • MD5

    4638dcaef1732ca87b223ddf90ff4828

  • SHA1

    1a2303d4521505c7c3fcd54ca1882240c4fc72e6

  • SHA256

    52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e

  • SHA512

    db00ec5f08801ae14a135e0de47ac6161c29dd3946234dc43fe7a649edb6a05dc572a76b35fe363df9e954033381158dc16dc63a2ae682537a13526be2ef1f3e

Score
10/10
teslacryptpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\_ReCoVeRy_+ftvql.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6 2 - http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6 3 - http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/CBA0A4FF1DD257A6 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6 http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6 http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/CBA0A4FF1DD257A6
URLs

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6

http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6

http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6

http://xlowfznrg4wf7dli.ONION/CBA0A4FF1DD257A6

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\_ReCoVeRy_+ftvql.html

Ransom Note
<html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center> <div style="text-align:left; font-family:Arial; <!---4231213423142134231421342341234 --> font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> <b><font class="ttl"><center><b>NOT YOUR LANGUAGE? USE <a href="https://translate.google.com" target="_blank">Google Translate</a></b></center> What<!------4231213423142134231421342341234 --> happened <!------4231213423142134231421342341234 --> to your<!------4231213423142134231421342341234 --> files?</b></font><br> <font style="font-size:13px;">All <!------4231213423142134231421342341234 -->of your files<!------4231213423142134231421342341234 --> were <!------4231213423142134231421342341234 --> protected by a strong<!------4231213423142134231421342341234 --> encr<!---4231213423142134231421342341234 -->yption wi<!---4231213423142134231421342341234 -->th <!------4231213423142134231421342341234 -->RSA4096 <!------4231213423142134231421342341234 --> <br> More <!------4231213423142134231421342341234 --> information about the <!------4231213423142134231421342341234 -->encryption RSA4096 can be<!------4231213423142134231421342341234 --> fou<!---4231213423142134231421342341234 -->nd <a href= http://en.wikipedia.org/wiki/RSA_(cryptosystem) target="_blank"> htt<!--4231213423142134231421342341234 -->ps:<!--4231213423142134231421342341234 -->//en<!--4231213423142134231421342341234 -->.w<!--4231213423142134231421342341234 -->ikipedia<!--4231213423142134231421342341234 -->.<!--4231213423142134231421342341234 -->org/wiki/RSA_(cry<!--4231213423142134231421342341234 -->ptosystem) </a><br></font> <br><b><font class="ttl">Wh<!--4231213423142134231421342341234 -->at <!------4231213423142134231421342341234 --> does th<!--4231213423142134231421342341234 -->is mean?</b></font><br><font style="font-size:13px;"> T<!--4231213423142134231421342341234 -->his<!------4231213423142134231421342341234 --> mea<!--4231213423142134231421342341234 -->ns that the <!------4231213423142134231421342341234 --> str<!--4231213423142134231421342341234 -->ucture and da<!--4231213423142134231421342341234 -->ta wi<!--4231213423142134231421342341234 -->thin your <!------4231213423142134231421342341234 -->files ha<!--4231213423142134231421342341234 -->ve be<!--4231213423142134231421342341234 -->en<!------4231213423142134231421342341234 --> irre<!--4231213423142134231421342341234 -->voca<!--4231213423142134231421342341234 -->bly changed, you will not be able work wi<!--4231213423142134231421342341234 -->th them, read<!------4231213423142134231421342341234 --> th<!--4231213423142134231421342341234 -->em or see them, <!------4231213423142134231421342341234 -->it is the s<!--4231213423142134231421342341234 -->ame thing <!------4231213423142134231421342341234 -->as los<!--4231213423142134231421342341234 -->ing <!------4231213423142134231421342341234 -->them for<!--4231213423142134231421342341234 -->ever, but with our he<!--4231213423142134231421342341234 -->lp, you <!------4231213423142134231421342341234 --> can re<!--4231213423142134231421342341234 -->st<!--4231213423142134231421342341234 -->ore t<!--4231213423142134231421342341234 -->hem <br><br><b><font class="ttl"><!------4231213423142134231421342341234 -->Ho<!--4231213423142134231421342341234 -->w d<!--4231213423142134231421342341234 -->id th<!--4231213423142134231421342341234 -->is hap<!--4231213423142134231421342341234 -->pen?<!------4231213423142134231421342341234 --></b></font> <br> <!------4231213423142134231421342341234 --> <font style="font-size:13px;"><!------4231213423142134231421342341234 --> Espec<!--4231213423142134231421342341234 -->ially for y<!--4231213423142134231421342341234 -->ou,<!------4231213423142134231421342341234 --> on our SER<!--4231213423142134231421342341234 -->VER <!------4231213423142134231421342341234 -->was gene<!--4231213423142134231421342341234 -->rated <!------4231213423142134231421342341234 -->the sec<!--4231213423142134231421342341234 -->ret k<!--4231213423142134231421342341234 -->ey <br>Al<!--4231213423142134231421342341234-->l y<!--4231213423142134231421342341234-->our <!------4231213423142134231421342341234 --> files w<!--4231213423142134231421342341234-->ere encry<!--4231213423142134231421342341234-->pted with the p<!--4231213423142134231421342341234-->ublic k<!--4231213423142134231421342341234-->ey, <!------4231213423142134231421342341234 --> wh<!--4231213423142134231421342341234-->ich has b<!--4231213423142134231421342341234-->een <!------4231213423142134231421342341234 --> trans<!--4231213423142134231421342341234-->ferred to <!------4231213423142134231421342341234 -->y<!--4231213423142134231421342341234-->our co<!--4231213423142134231421342341234-->mputer via <!------4231213423142134231421342341234 -->the Inter<!--4231213423142134231421342341234-->net.<!--4231213423142134231421342341234--><br> <!------4231213423142134231421342341234 --> Decr<!--4231213423142134231421342341234-->ypting of <!------4231213423142134231421342341234 -->YO<!--4231213423142134231421342341234-->UR FI<!--4231213423142134231421342341234-->LES is <!--4231213423142134231421342341234 -->on<!--4231213423142134231421342341234 -->ly p<!--4231213423142134231421342341234 -->oss<!--4231213423142134231421342341234-->ible <!--- -4231213423142134231421342341234 -->w<!--4231213423142134231421342341234 -->ith the he<!--4231213423142134231421342341234-->lp of t<!--4231213423142134231421342341234 -->he <!----4231213423142134231421342341234 -->pri<!--4231213423142134231421342341234-->va<!--4231213423142134231421342341234 -->te k<!--4231213423142134231421342341234-->ey a<!--4231213423142134231421342341234 -->nd <!--4231213423142134231421342341234 -->d<!--4231213423142134231421342341234 -->ecr<!--4231213423142134231421342341234-->ypt p<!--4231213423142134231421342341234 -->rog<!--4231213423142134231421342341234-->ram <!--4231213423142134231421342341234 -->wh<!--4231213423142134231421342341234-->ich is on our <!--- -4231213423142134231421342341234 -->Sec<!--4231213423142134231421342341234-->ret <!--4231213423142134231421342341234 -->Ser<!--4231213423142134231421342341234-->ver!!! </font><br><br><b><font class="ttl">Wh<!--4231213423142134231421342341234-->at do I do?</b></font> <br><font style="font-size:13px;">Alas, if you <!--4231213423142134231421342341234 --> do not take <!---4231213423142134231421342341234 --> the nece<!--4231213423142134231421342341234-->ssary meas<!--4231213423142134231421342341234-->ures <!--4231213423142134231421342341234-->for the spec<!--4231213423142134231421342341234-->ified ti<!--4231213423142134231421342341234-->me th<!--4231213423142134231421342341234-->en t<!--4231213423142134231421342341234-->he co<!--4231213423142134231421342341234-->nditions fo<!--4231213423142134231421342341234-->r obta<!--4231213423142134231421342341234-->ining the priv<!--4231213423142134231421342341234-->ate ke<!--4231213423142134231421342341234-->y w<!--4231213423142134231421342341234-->ill be cha<!--4231213423142134231421342341234-->nged<!--- 4231213423142134231421342341234 --> <br> <!-----4231213423142134231421342341234 --> If you really need <!------4231213423142134231421342341234 --> your data, <!------4231213423142134231421342341234 -->then we suggest you <!------4231213423142134231421342341234 --> do not waste<!------4231213423142134231421342341234 --> valuable <!------4231213423142134231421342341234 --> time searching <!------4231213423142134231421342341234 -->for other <!------4231213423142134231421342341234 --> solutions <!------4231213423142134231421342341234 -->becausen <!----4231213423142134231421342341234 --> they do not exist.</font><br><br> <!----4231213423142134231421342341234 --><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please<!------4231213423142134231421342341234 --> visit your <!------4231213423142134231421342341234 --> personal <!------4231213423142134231421342341234 -->home page,<!------4231213423142134231421342341234 --> there are<!------4231213423142134231421342341234 --> a few <!------4231213423142134231421342341234 -->different <!------4231213423142134231421342341234 -->addresses<!------4231213423142134231421342341234 --> pointing to <!------4231213423142134231421342341234 --> your page<!------4231213423142134231421342341234 --> below:<b><hr> <!---2+1=3---> 1 - <a href=http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6 target="_blank">http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6</a> <br> <!------2+1=3 --> 2 - <a href=http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6 target="_blank">http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6</a> <br> <!------2+1=3 --> 3 - <a href=http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6 target="_blank">http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6</a> <br> <!------2+1=3 --></div><br><div class="tb" style="font-size:13px; border-color:#880000;"><b>If for some reasons the <!-----2+1=3 --> addresses are not available, <!------2+1=3 --> follow these steps:</b> <hr> 1 - <!------2+1=3 --> Download and <!------2+1=3 --> install tor-browser: <a href=http://www.torproject.org/projects/torbrowser.html.en target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br> 2 - <!---2+1=3 --> Af<!---2+1=3--->ter a<!---2+1=3---> succe<!---2+1=3--->ssful<!------2+1=3 --> instal<!---2+1=3--->lation, run the br<!---2+1=3--->owser and w<!---2+1=3--->ait for initi<!---2+1=3--->alization.<br> 3 - <!--- 2+1=3 --> Ty<!---2+1=3--->pe<!-- 2+1=3 --> in<!-- 2+1=3 --> the t<!---2+1=3--->or-bro<!---2+1=3--->wser<!-- 2+1=3 --> add<!---2+1=3--->ress<!-- 2+1=3 --> bar: <font style="font-weight:bold; color:#009977;"><!-- 2+1=3 -->xlowfznrg4wf7dli.onion/CBA0A4FF1DD257A6<!-- 2+1=3 --></font><!-- 2+1=3 --><br> 4 - <!--- 2+1=3 --> Fol<!---2+1=3--->low the instr<!---2+1=3--->uctions <!-- 2+1=3 --> on the site.</div><br><br><b>!!! IMPO<!---2+1=3--->RTANT INFO<!---2+1=3--->RMATION:</b><br> <!-----2+1=3 --><div class="tb" style="width:790px;"><!-----2+1=3 --> Yo<!---2+1=3--->ur Pers<!---2+1=3--->onal PAGES<b>: <br> <a href=http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6 target="_blank">http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/CBA0A4FF1DD257A6</a> <br><a href=http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6 target="_blank">http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/CBA0A4FF1DD257A6</a> <br> <!-----2+1=3 --><a href=http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6 target="_blank">http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/CBA0A4FF1DD257A6</a> <br> <!-----2+1=3 --> Your <!------2+1=3 --> Personal TOR-Browser<!-----2+1=3 --> page : <!-----2+1=3 --><font style="font-weight:bold; color:#009977;"><!-- 2+1=3 -->xlowfznrg4wf7dli.onion/CBA0A4FF1DD257A6<!-- 2+1=3 --></font><br> <!-----2+1=3 --> Your personal <!------2+1=3 --> ID <!-----2+1=3 --> (if you open <!------2+1=3 --> the site directly): <!-----2+1=3 --> <font style="font-weight:bold; color:#770000;">CBA0A4FF1DD257A6</font><br> </div></div></center></body></html>

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e.exe
    "C:\Users\Admin\AppData\Local\Temp\52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\fxtojbpqqatx.exe
      C:\Windows\fxtojbpqqatx.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1532
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:272
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:808 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1704
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\52E13C~1.EXE
      2⤵
      • Deletes itself
      PID:1128
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1868
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
    Filesize

    11KB

    MD5

    9ccc9edf7596875d876d3900e2b3337f

    SHA1

    8b13099f64b3b36ae47f3f23babae98f696dec7c

    SHA256

    584ac134706cf1af0b74c5c2cb4b05ecc4f8a68361f215335cbff37970c5acc4

    SHA512

    acc057147eaeaccd7f9a657f0fc052c7f9c2467e1896145c081368d7ad837c44b45ea0c301e4365a63e3efe18287c401f1726c2a99a81d7e6129eaa54682d2c2

    Download Submit

  • C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
    Filesize

    1KB

    MD5

    5ad1bc78353fb346f48b53becab61a3a

    SHA1

    f2138d250eb9fd9ff5cf631f8b34fbac08e9d7a1

    SHA256

    61d92d4c0d4fbe9d0dc14ffc94d85661abe48bfb3f5534bb999db2e68eed43e4

    SHA512

    025a578b8b91224f1c2fcf24222a3779ce66796a9794e6f1b0e5715ee184195f0f2f60294a0fcb4ee68f63ee01e965b7e700f6ceaa400f355345918364cb4434

    Download Submit

  • C:\Users\Admin\Desktop\_ReCoVeRy_.png
    Filesize

    65KB

    MD5

    5bfc4c85fb7c456ab2a296b80034a409

    SHA1

    182958d21610a8e1041d3eb6df8446c6f7edf55e

    SHA256

    c2225def8b7ec35926d473370582b537c5c795a2bf028e935e6fd4e9b68ea6f6

    SHA512

    87c9e162b63ad3eb96a77d93a60d7d7deb159176e63b5e9606c6df199644201e9f4a27ff40ac1702e17469a7725f41c81782d37e03a9a845b08c6d25070ab484

    Download Submit

  • C:\Windows\fxtojbpqqatx.exe
    Filesize

    325KB

    MD5

    4638dcaef1732ca87b223ddf90ff4828

    SHA1

    1a2303d4521505c7c3fcd54ca1882240c4fc72e6

    SHA256

    52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e

    SHA512

    db00ec5f08801ae14a135e0de47ac6161c29dd3946234dc43fe7a649edb6a05dc572a76b35fe363df9e954033381158dc16dc63a2ae682537a13526be2ef1f3e

    Download Submit

  • C:\Windows\fxtojbpqqatx.exe
    Filesize

    325KB

    MD5

    4638dcaef1732ca87b223ddf90ff4828

    SHA1

    1a2303d4521505c7c3fcd54ca1882240c4fc72e6

    SHA256

    52e13c80fdbd1cae03d0c7121443a06433af173a12c370325df22e97f9afd81e

    SHA512

    db00ec5f08801ae14a135e0de47ac6161c29dd3946234dc43fe7a649edb6a05dc572a76b35fe363df9e954033381158dc16dc63a2ae682537a13526be2ef1f3e

    Download Submit

  • memory/1532-62-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/1532-64-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/2000-54-0x0000000076191000-0x0000000076193000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2000-61-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/2000-56-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/2000-55-0x00000000004E0000-0x000000000050F000-memory.dmp

    Filesize

    188KB

    Download