Overview

overview

10

Static

static

3

2a6d24e886...18.exe

windows7-x64

10

2a6d24e886...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a6d24e8860bbd84be02f3062d16a753_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    2a6d24e8860bbd84be02f3062d16a753

  • SHA1

    f7d4cf1c34c98c365b6d0db5da54fffc1f6cf70d

  • SHA256

    37c84094c452b235cc310346dea26829afe3e714383ccfa03beeaadd952200e1

  • SHA512

    602cd0a0d3d3fc7c55a21fc43672e5611044f450e10b13df597504867ef62d58dbef4e1730fdff4c1d0c7bfe6d43503de3827d3f407788e937e886593bd2412b

  • SSDEEP

    6144:vcx+HObXwqYhtJwrJpPiGwic9WpAaUFlWzXARG8tdNeIFmi886hxLA8jHntLT:j7/gJpPiGTcApAQXCzdN9Fm9bc8

Score
10/10
teslacryptdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+hwrkw.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BDAF98769F4E9E6F 2. http://tes543berda73i48fsdfsd.keratadze.at/BDAF98769F4E9E6F 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BDAF98769F4E9E6F If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/BDAF98769F4E9E6F 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BDAF98769F4E9E6F http://tes543berda73i48fsdfsd.keratadze.at/BDAF98769F4E9E6F http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BDAF98769F4E9E6F *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/BDAF98769F4E9E6F
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BDAF98769F4E9E6F

http://tes543berda73i48fsdfsd.keratadze.at/BDAF98769F4E9E6F

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BDAF98769F4E9E6F

http://xlowfznrg4wf7dli.ONION/BDAF98769F4E9E6F

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (425) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a6d24e8860bbd84be02f3062d16a753_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a6d24e8860bbd84be02f3062d16a753_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\2a6d24e8860bbd84be02f3062d16a753_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2a6d24e8860bbd84be02f3062d16a753_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\dhocjaekutqc.exe
        C:\Windows\dhocjaekutqc.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\dhocjaekutqc.exe
          C:\Windows\dhocjaekutqc.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1652
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2400
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:2164
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2744
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\DHOCJA~1.EXE
            5⤵
              PID:1536
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2A6D24~1.EXE
          3⤵
          • Deletes itself
          PID:2416
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1248
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:240

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+hwrkw.html
      Filesize

      11KB

      MD5

      575b593e345bc2e7eaf8588662384e89

      SHA1

      6990cc765d79a735c9e2fe9de686259545ec8422

      SHA256

      b5d148ff37b88da50e9d0b40241a5ae063c63ab7e9bf1f5619dee914fe3ccd4e

      SHA512

      9587ce5be5df6bbd279e4e16c3dd28cd40e98e28bfccbb67782118ca73d34f6924cc41f115f31c80ea4f68175c6a772a52f4b9494ffb9dcf6193aee2ef49b43c

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+hwrkw.png
      Filesize

      62KB

      MD5

      810b4b0d5013d38d939fa16930f8ef9a

      SHA1

      bb25ccb1c635d85baa22c8808460736cb64ff85d

      SHA256

      3d9185dc3c70e464fa080b33d814a6b49759c3fb76bf561c9c43b83fd78829b8

      SHA512

      c1bb1645f6ce715f320b5321782b2105e04aa7ccedcd6388c651e9e26522eba81025baea26b24ce453d976a2154940663a663b2a318121d29e72a381a2e6cb62

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+hwrkw.txt
      Filesize

      1KB

      MD5

      cdb35713be8c50eb3235ea83975b2300

      SHA1

      bc816f5316d8b941132538309f0e0bfe25695361

      SHA256

      a9586ffe90aaab09ac2dadb0a3c7f153ca6e004387793f9869fd5000bafb1644

      SHA512

      011e6177701d4b86973e8dc566241d584b0157518bc4f5ab4f71b6e78fbae2d426b5bd71c2aa1353f86ef604d76c0e36322f0fc09397f2e4612e71fb72f07814

      Download Submit

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
      Filesize

      11KB

      MD5

      4df1ced662c9fefb1b02bbc3c88e15f2

      SHA1

      c605381552dc16d0c78656e05101bd8c8bb58d29

      SHA256

      fa42e6f8c1ba16a311318c613ac377bf050ba198a6001f0c623a9ce3f51b35b5

      SHA512

      1892a196561a93b380264f94ddb6ff89234ad20a36d619f81cedf75ad7bf2438585a6a53cb290a5b110d8bd236adc425ab2107f49ff5c27a10c155196d0c3687

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
      Filesize

      109KB

      MD5

      9ba0b9c26b87c246029c38ffdf84ca4d

      SHA1

      fec643c4d8e17707aaf434e0b494084423ccb2bb

      SHA256

      9caa988bbd1b612358bef83541e583845613c56bd49df7b9a4396ffc7f8bf717

      SHA512

      7365130adbbb21c207144b358412a4f0d59b2c026a6b284d37a42b41ea3d8e4a48eb1a7b40080849950541ea36bb014767c1b9d2357a641df79b168fe20d8368

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
      Filesize

      173KB

      MD5

      7ba56892280c3d13ecabe9bb61b11081

      SHA1

      2192b6b368e56b2d822f679b001e0920f0b9d5a7

      SHA256

      ecd1bb90c568b1dbf2cd98744329f9b727a54708b203aab99e52978110d91e57

      SHA512

      282b529e5cc1c046b79bc6a780b2b30a79e2ddf30aaf1e4d2ba1fbdfc1ed47fedc35ca54bfcc42a2c7df3594ad81267c88bdebe8d7655dfe8a6c010275c37090

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d7256e768a989afe3830eca11b54cedb

      SHA1

      db23515d2b4e12baa27f7ac0d5113c5962d8c588

      SHA256

      c97dfb97948524cc77f1f3c2af1bf151dc8be1f0079e9fe75410ebc2ffaceefe

      SHA512

      da7ed5b1a88d03d729e586669c42af2d4c8b5c8fd3358995c203e936b6bf4d072986e441ce4d910088b66d47f4950e0eef7bca22993cbee50ac98bdba3f427ca

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      798fd55eec879ec0bafa95f6f3f67491

      SHA1

      fecd8e2d5463dbc10352de6840f94fbc85740bd9

      SHA256

      d3377b04131b58f42b225b295abb8ceeeebf03a4a5c183aa1ab48dcb2d9e6a45

      SHA512

      d82707cc77c5f089f3cf1ffa2cd86569abce75996612d77888fb9c1a31f728ad173bcb3cbb42a91177e2743787e791c73547e3d30a18da85195163e62232c558

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      89c6a0101952c6a392f63fc71623f45c

      SHA1

      2478e890c655791028efdf2baa53c94cfdf1f2aa

      SHA256

      7af30ded20a1ede6366e8fdb42124492103f3f5ff867b31195540b0591412e7a

      SHA512

      58c521146109febf23f4b57262453f2b01bd5f861eddf4e6b7c2f354984fb71ef220892161f1740610d1ec43a1e75454e037cb6a930422172dbbb0390cdce9e6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      1606a6723ea078c4f10b82ce6687785f

      SHA1

      ec865b184e4d2f50a6869aa4a862c41346a7d99b

      SHA256

      cd97157efc2325029116a5b5b46da6428ae863113dac21d0640ce06be7939982

      SHA512

      be206fc95a8328145166b7f32a3b43475a789778b6a8ec29bcd04f202e8eec75fe6d2ee159d15c12f876dc7c111f736317a29e9c6a27ed8752a1db47204a716b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      2294c6989c060b1af10f49e5163723ac

      SHA1

      9259ab4be4c9e615fe4702f9dd654aedacde3748

      SHA256

      8884bc90aff7fdc56e1f23114bd507c5d28dd444ba005a23176b359f18c13e1e

      SHA512

      b787e166e7ed48d1664e5b23fead07def2e6cb3ed1bc836e2e8e829551158bb2ca0fb89e848bf97b9956ce94c39e88389a2d877b62f27acbec6c3784177a1bcd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      ab0c97fd7751afa2e1d958575a59527d

      SHA1

      7f0e48a2c6a1de008312b9eb513dfd17264529d4

      SHA256

      a0161c152f932e9b11e50862487144f7e4b6425cbb9b00dcd0f2f0066b840456

      SHA512

      3de49bb7f0e93b49ca551d322fc59492914aa847ff59dea1772a762a18f915d631d2ecd4947f75423b7055ee09366e2f12d0201fe9e5728abfaa7790cf9a73cd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      7b0fd0fa264d5f4da8f02de421265b84

      SHA1

      48255cc7f6b22eba5dc618183889dded4bd28009

      SHA256

      a4358d5a7c7cba220c90d25a0cb2ddc4ce67360b18adf3efc3cd84308404f20c

      SHA512

      82c1600b2da1896cca8a16d253e30b829cd9e75860d71da3e9bd08fb3e4c5ab8124fe7f137578a2219eaef9e7b65c5054d3e0c069eeff08257b273ae9045e2cd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      df4c1e35fa35db3e84d5c4eaad5c845c

      SHA1

      d39fd2e6058ebd0dae6bbe251a70c6692b3f43c0

      SHA256

      2b035efa769f2f3258468255c8235c58a0387650ff50cd5c6e614dc4ace5ce24

      SHA512

      8ac8d9566e354ce3973d2cca09e34124035dbdab3680cdfb36c6cae50254ae8b9f2479f9c89b565d3cbaddddee41d95dadd3d6eab0cdfff9152fe2633e4fdb3d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab934D.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar941F.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      Download Submit

    • C:\Windows\dhocjaekutqc.exe
      Filesize

      352KB

      MD5

      2a6d24e8860bbd84be02f3062d16a753

      SHA1

      f7d4cf1c34c98c365b6d0db5da54fffc1f6cf70d

      SHA256

      37c84094c452b235cc310346dea26829afe3e714383ccfa03beeaadd952200e1

      SHA512

      602cd0a0d3d3fc7c55a21fc43672e5611044f450e10b13df597504867ef62d58dbef4e1730fdff4c1d0c7bfe6d43503de3827d3f407788e937e886593bd2412b

      Download Submit

    • memory/240-6026-0x0000000000130000-0x0000000000132000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1652-1552-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-5678-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-48-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6520-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-46-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-44-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-2497-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6094-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6019-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6025-0x0000000002AE0000-0x0000000002AE2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1652-45-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6028-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-6517-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/1652-50-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-26-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-2-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-16-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-5-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-7-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-9-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2544-15-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-13-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2544-3-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

      Download

    • memory/2836-0-0x0000000000400000-0x000000000086C000-memory.dmp

      Filesize

      4.4MB

      Download

    • memory/3048-27-0x0000000000400000-0x000000000086C000-memory.dmp

      Filesize

      4.4MB

      Download