edf98c8d92926d258cf70c2348ab4c68d31b377cd273b0686f12e3545089030b

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74e40db78ff482c904336c92e5702683.exe
Size

92KB
MD5

74e40db78ff482c904336c92e5702683
SHA1

f658ff3be7916158ac27ded4a9e15586c794a7fc
SHA256

42be9bd6089404ffe72b9f728a9e01902e87844215735e71e62207ea9939875a
SHA512

7d73191a4294ab6a23ba405f760aba3ba04f9085b2a1565135b07446d402eec83e729c3620bd56c42e07fc568acadfa2d4076460396038affc71c98944d94a70
SSDEEP

1536:Eu9ZnfCDXBTambyG5WzWwbBIRBxnbFswTWGKcl:EwCDxH9wbUhW1Y

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\PerfLogs\# How to Decrypt Files-CLHUM.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: white; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { border: 1px solid #888; background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text { text-align: justify; } .lsb{ display: none; margin: 3%; text-align: center; } .ls { cursor: pointer; border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover { background-color: #D0D0D0; } .l { display: none; } .lu { display: none; } #change_language { float: right; display: none; } </style> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> </div> <div class='container'> <div class="text l l-en" style='display:block'> <div> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" /> </div> <samp># All your files has been encrypted by "KRAKEN CRYPTOR".</samp> <samp># Read the following instructions carefully to decrypt your files.</samp> <div class="info"> -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- pFLWkhdMxa5RgLX5zh9sQ9+6l+oHHsHBr5naGSqLEFWRdHkYtgrO6HhygIg5KfeH AE5wAz2ecNdc6md19GEmJbPNvrj4EWxPfka6R7qhoUsspnHRK7/0TYmPO//QEfpw rXo5p1cBcTObnIFeq8P1JbDkL8SJzntQIw8y2S5IPCjZw1+hXINIctOS3ZUM4azj ABDS5cElQQiRsIZ7z+iJkSnHYN7iaVO+IjkeA7VNPWjrFL0W9ZFG0SvujxuESkKH jf75MiSK7rzXKOcYWvIiAqqoAmAMW2uTCxrIeqPSKAil/Cn2bHcd9MGFXcMWluiu 84Xwi+BayMO/tO46aVo4sBPT2TJTqHJIbWXB7wOj70mkZJmgO+kZfH0fxv8TcEcO 9sfnleaYSwHFnjbR+aBRPVP3DNU13dg5QYXimiDDJDCJ7o3d3PjwieAoeKhTbuBu Scfee+QxfaPQbc3m6koPSUNawW2XPENv5kQiRUYknxTeRAGiCyvKJrd2F2jz0Gjy w4k0+S6selReL3hZ6SEbESVDsPTHfKDOn9nc9YnWITtuODzmCWiEQ8HCgoM1N/X5 vhiyjMVdm8HWtiYNgsEByXWa6EPDlBPIqs+amPxX1m+fIFMBc9agqX0/pXL5Hojv i2/Ba8YJka1o+VvZVX3Mtcuu0Sg4OmT4sh2+ZGqsPXz5Nh/yOphp4ZTq8ourt1W4 EFujjlxe+EHoAGa81+hbl9ylCRHpiMEHr9OlpRreBZg= -----END KRAKEN ENCRYPTED UNIQUE KEY----- </div> Extension <div class="info"> .CLHUM </div> What happened to my computer? <hr> All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by "KRAKEN CRYPTOR"! Don't delete .CLHUM files! there are not virus and are your files, but encrypted! The speed, power and complexity of this encryption have been high and if you are now viewing this guide. It means that "KRAKEN CRYPTOR" immediately removed form your system! No way to recovery your files without "KRAKEN DECRYPTOR" software and your computer "UNIQUE KEY"! You need to buy it from us because only we can help you! How can recovery my files? <hr> We guarantee that you can recover all your files soon safely. You can decrypt one of your encrypted smaller file for free in the first contact with us. For the decryption service, we also need your "KRAKEN ENCRYPTED UNIQUE KEY" you can see this in the top! Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us! After your payment made, all of your encrypted files has been decrypted. How much is need to pay? <hr> You need to pay (0.25 BTC), payment only can made as Bitcoins. This links help you to understand whats is a Bitcoins and how it work. <a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a> This price is for the contact with us in first week otherwise it will increase. Where can buy Bitcoins? <hr> The easiest way to buy Bitcoins is LocalBitcoins website. You must register on this site and click "BUY Bitcoins" then choose your country to find sellers and their prices. <a href="https://localBitcoins.com">https://localBitcoins.com</a> Other places to buy Bitcoins in exchange for other currencies worldwide: <a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a> How to contact you? <hr> We use best and easy way to communications. It's email support, you can see our emails below. Please send your message with same subject to both address. E-Mail <div class="info"> [email protected] </div> Alternative <div class="info"> [email protected] </div> Attention <hr> <ul type="disc"> <li>DON'T MODIFY OR RENAME ENCRYPTED FILES.</li> <li>DON'T MODIFY "KRAKEN ENCRYPT UNIQUE KEY".</li> <li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY.</li> <li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE.</li> </ul> Additional <hr> <ul type="square"> <li>Project "KRAKEN CRYPTOR" doesn't damage any of your files, this action is reversible if you follow the instructions above.</li> <li>Also, our policy is obvious: "NO PAYMENT, NO DECRYPT".</li> </ul> </div> </div> </body> </html>

Emails

[email protected]

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

74e40db78ff482c904336c92e5702683.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	74e40db78ff482c904336c92e5702683.exe

Executes dropped EXE 1 IoCs

Processes:

sdelete.exe

pid process

760 sdelete.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 ipinfo.io
32 ipinfo.io

pid	process
760	sdelete.exe

flow	ioc
29	ipinfo.io
32	ipinfo.io

Drops file in Program Files directory 2 IoCs

Processes:

74e40db78ff482c904336c92e5702683.exe

description	ioc	process
File created	C:\Program Files\Touch	74e40db78ff482c904336c92e5702683.exe
File created	C:\Program Files (x86)\Touch	74e40db78ff482c904336c92e5702683.exe

Drops file in Windows directory 1 IoCs

Processes:

74e40db78ff482c904336c92e5702683.exe

description ioc process

File created C:\Windows\Touch 74e40db78ff482c904336c92e5702683.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1664 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3056 PING.EXE

description	ioc	process
File created	C:\Windows\Touch	74e40db78ff482c904336c92e5702683.exe

pid	process
1664	tasklist.exe

pid	process
3056	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

74e40db78ff482c904336c92e5702683.exetasklist.exe

pid	process
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe
1664	tasklist.exe
1664	tasklist.exe
2432	74e40db78ff482c904336c92e5702683.exe
2432	74e40db78ff482c904336c92e5702683.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

74e40db78ff482c904336c92e5702683.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2432	74e40db78ff482c904336c92e5702683.exe
Token: SeIncBasePriorityPrivilege	2432	74e40db78ff482c904336c92e5702683.exe
Token: SeDebugPrivilege	1664	tasklist.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

74e40db78ff482c904336c92e5702683.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2432 wrote to memory of 1664	2432	74e40db78ff482c904336c92e5702683.exe	tasklist.exe
PID 2432 wrote to memory of 1664	2432	74e40db78ff482c904336c92e5702683.exe	tasklist.exe
PID 2432 wrote to memory of 1664	2432	74e40db78ff482c904336c92e5702683.exe	tasklist.exe
PID 2432 wrote to memory of 4832	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 2432 wrote to memory of 4832	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 2432 wrote to memory of 4832	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 2432 wrote to memory of 4860	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 2432 wrote to memory of 4860	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 2432 wrote to memory of 4860	2432	74e40db78ff482c904336c92e5702683.exe	cmd.exe
PID 4860 wrote to memory of 3056	4860	cmd.exe	PING.EXE
PID 4860 wrote to memory of 3056	4860	cmd.exe	PING.EXE
PID 4860 wrote to memory of 3056	4860	cmd.exe	PING.EXE
PID 4832 wrote to memory of 2404	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 2404	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 2404	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 4468	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 4468	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 4468	4832	cmd.exe	reg.exe
PID 4832 wrote to memory of 4396	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 4396	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 4396	4832	cmd.exe	cmd.exe
PID 4396 wrote to memory of 760	4396	cmd.exe	sdelete.exe
PID 4396 wrote to memory of 760	4396	cmd.exe	sdelete.exe

C:\Users\Admin\AppData\Local\Temp\74e40db78ff482c904336c92e5702683.exe
"C:\Users\Admin\AppData\Local\Temp\74e40db78ff482c904336c92e5702683.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\tasklist.exe
"tasklist" /V /FO CSV
2⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C cd C:\ProgramData\ && release.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"
3⤵
PID:2404

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f
3⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\ProgramData\sdelete.exe -c -z C:
3⤵
- Suspicious use of WriteProcessMemory
PID:4396

C:\ProgramData\sdelete.exe
C:\ProgramData\sdelete.exe -c -z C:
4⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\74e40db78ff482c904336c92e5702683.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
3⤵
- Runs ping.exe
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4272 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\# How to Decrypt Files-CLHUM.html
Filesize
9KB

MD5
44704c92de61e14ff93cbc11f72f2502

SHA1
e7ffac1add7df06d1972f393e1ff956d64dbd088

SHA256
e328e410a2ed2393cd62ad7708e9a149651501700e166141b31d9fa673cd7e95

SHA512
4d27cf11cda1c784311af1769252f7d0e702d1b7a76b6f94d035cab16cc038f8118e57bef84d53139e02ed5fb29319cd891a93e1316f28c0ac41f0d683253667

Download Submit
C:\ProgramData\release.bat
Filesize
875B

MD5
ed51564efba7197a56ad8d5fb508ac12

SHA1
6b79b10c6aab091fa722373ed6cc533f24febe79

SHA256
de8036a2336605847f263fbd7db3204a63469ab9e96d5fcd167898ca0d14df69

SHA512
eafe939d2b8a67f21f2672deb8667526e46d57fe74331dcba726acc573ebf9ed3fcfd79dff01457cdf9fdf5eb171da51d61e430b84f417eabd5ba12dbecd0fbb

Download Submit
C:\ProgramData\sdelete.exe
Filesize
218KB

MD5
6a4e049d8c497d350a7bd54dfff99808

SHA1
7f1d32424c961542ae172c5b8c1611291c30fc4f

SHA256
59e5ae1e99c6a4ccc01e8abdc2534210ec5faa945754a89524b06381da8c20a1

SHA512
41169089fa67e1a0ff1360dc5428b89dcee0d642204ddb7dac80d6cf859caae3c2b14fa89ce72072fb780c0a93f53eb0ff9414a8e88b1d783bfa75c9c4ea353d

Download Submit
memory/2432-9-0x00000000749C2000-0x00000000749C3000-memory.dmp

Filesize
4KB

Download
memory/2432-12-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-5-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-6-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-7-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-8-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-10-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-0-0x00000000749C2000-0x00000000749C3000-memory.dmp

Filesize
4KB

Download
memory/2432-11-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-4-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-13-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-14-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-15-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-16-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-17-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-3-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-96-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-2-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-1-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2432-375-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download