Overview

overview

10

Static

static

3

546fe4e8d2...18.exe

windows7-x64

10

546fe4e8d2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 11:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    546fe4e8d28a6c67a1047286eb57d773_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    546fe4e8d28a6c67a1047286eb57d773

  • SHA1

    19a807a5fe6f1974ea4ba5f2bafb5cf4edb56f23

  • SHA256

    828cd60f0928c571477a4e351b0d98d0d03abe48f0b67a9ed605a2eb8dab5c4c

  • SHA512

    702ac5cd5e84d6157ab79fc6e41fa4fc1075e72318459345e7e75db200c07d09bf20d7f5b759c53e1207f80d0bbc2f5ab2c464b3cd8c8b8d4ffbc1b32707e5f2

  • SSDEEP

    6144:7tguKU1XD9oEmWMF6L2IzjAqXuxoaqHwdfOUavNJ3en9THb3IA/OYILI:+uRBoOc4js11GUfVsNJ3entMAWp

Score
10/10
teslacryptdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+viyyl.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AAD681CC366CFAA 2. http://tes543berda73i48fsdfsd.keratadze.at/AAD681CC366CFAA 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AAD681CC366CFAA If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/AAD681CC366CFAA 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AAD681CC366CFAA http://tes543berda73i48fsdfsd.keratadze.at/AAD681CC366CFAA http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AAD681CC366CFAA *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/AAD681CC366CFAA
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AAD681CC366CFAA

http://tes543berda73i48fsdfsd.keratadze.at/AAD681CC366CFAA

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AAD681CC366CFAA

http://xlowfznrg4wf7dli.ONION/AAD681CC366CFAA

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (414) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\546fe4e8d28a6c67a1047286eb57d773_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\546fe4e8d28a6c67a1047286eb57d773_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\546fe4e8d28a6c67a1047286eb57d773_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\546fe4e8d28a6c67a1047286eb57d773_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Windows\gfxfutdaqnqm.exe
        C:\Windows\gfxfutdaqnqm.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\gfxfutdaqnqm.exe
          C:\Windows\gfxfutdaqnqm.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2600
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2484
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:2824
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1280
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2172
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\GFXFUT~1.EXE
            5⤵
              PID:964
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\546FE4~1.EXE
          3⤵
          • Deletes itself
          PID:2708
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+viyyl.html
      Filesize

      11KB

      MD5

      2fea63d69d5d068dc682caeaf1bc0d7e

      SHA1

      146f1f1892e97c37c5d780581618e398a9a610f8

      SHA256

      459977edef8489ae5a98e4244372e2c44533a31e09b233f5ab003d6ad34f5fd0

      SHA512

      92a781dba59192ddafde7f7750cd2faffada0d50fa853aee36a83478078d9e0845a2c25e29caec5a1c1b011a926016b19d2ad8475d352035eec1d5b22a40de08

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+viyyl.png
      Filesize

      63KB

      MD5

      9a5fb4305f1698caa4b9c58397c21e5e

      SHA1

      5d07d9878d1e0de6111d4ae3bd5dc90f20a56efc

      SHA256

      351558aa7b7c2c39663f748ea0e42184763c214fff6c89f607e5ebaf4af7a7d7

      SHA512

      5cc799a68836b94b84658dbbfde7f04234cb71cdd9f51657e68b91c089e7daf09b42c87e2c47f7e1f9821459387b1ce67d7f7322528d04fb163e7b66f85d1cf0

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+viyyl.txt
      Filesize

      1KB

      MD5

      bf2efc04b9310f74bb3c67269ebe8877

      SHA1

      d9d1f578b60ba6287653a4bd5c7bbc16fcdc7eae

      SHA256

      6d7991cd344ad31a17c2333ac1a5e9fa3bca33bfb1d4f784e80ee317d9a131a9

      SHA512

      86486c441aea617ce353bd3375a9e480dcda67cc684e86690a15b40b92b7e6fdd97cc08bed6da3d48defa4d0e3d28920e9a0be4afd6efba45daad413195ec395

      Download Submit

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
      Filesize

      11KB

      MD5

      077539ba4cb72e4e1e531fad1274c521

      SHA1

      6cd18ef27369f1691ce2f78ae8d141406a30f98f

      SHA256

      973898b6129137e42dd3f455568d4e62b70509998dd56bc71d3a905745969ca0

      SHA512

      c54723b188f8d43f726cc7e2ca8360f4d897779c10f2c18d392e18da7500cc9f64ae5ea6a09f5fabd7e3b22c727c35b2b082bcb391d9110f60f445af0c8409ea

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
      Filesize

      109KB

      MD5

      9c76a5fee0942d7d7c8d1197512ca2a8

      SHA1

      e796f3097442b9a6f976b526830184f4de53541d

      SHA256

      7b4e9bd8068a5b89c95b8431202499e902767f954e3ce973c755eee11724bfb3

      SHA512

      6b11ac3c2458e4d2ffcfb1ca13fb31ef5af851d7fb24172b4d68ba7339c482481a3c1784170f4a1a84d92cb2978db617ad56ca921fbcb05f9f11a00facb2150b

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
      Filesize

      173KB

      MD5

      3ee53c77fe186614a23ea17608201b70

      SHA1

      10898874d648e6f6e97d95b940fc96f266c85c64

      SHA256

      b70c128b5998be36f7a305a6648f668d950329000b01b1e2bd834937d564cbc0

      SHA512

      e60aa38d5248060f0ee096e85e2d419154e7ff7031c1f1ec01526436cb9a5a2e8e2ed2f0cc6c5ba77b332ebbafbf60b040d2313b32784c7e39710b382b9af646

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      73420d19c0f7661da782707227abc1bb

      SHA1

      645f74c0011ca757c4774237ab45d47110e7a3c9

      SHA256

      8e462f46571a4dd95f530c68cac1350ea39c2c1474ece9eabebdf3670ca5623f

      SHA512

      7f0065ff23403c86226c7c3320c7c560f431806f764905636385fcf91354b49a3afe5aa816f454f2cdb0abc2a8975baa3297057e13f5fde635a34c3bffc08ce4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      48734221604449ff22acf405bb94292a

      SHA1

      a06873b813010468397678fced33c6c8d3a28d35

      SHA256

      5c66ff1ee0af2d7a5b5d535823d14fbeaaf5cd657a40adefe8356f972f8ac2e2

      SHA512

      817794ca4761a2f991e07434429785c9c050b09e1e078020567b2e3be1ac51d5dd2eca4ebf23d4088cefa33aeeb34d60f73d11e96fd52fbe5fbb4297210e3bde

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      c06e0b13e90ce1ac40d26cc3d82c510f

      SHA1

      5cfc62fc82afba1ae8d4f92c79cdffde87bb3e1e

      SHA256

      a0df6c849deffe1c7f5fc6aade630dac19750dd07de0e729fbb384ad7148861a

      SHA512

      1b059a4d9bb7707b11836688d6d07df69dbbf9112c45fb1e307cdfed2515cb1c4ee14dd30736d8b959e88bdcfc61e2afe68b0b72f4c5372c544c223c6d349c04

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d44c869daf80ea0dec2c48a17d9ada7a

      SHA1

      4d0acd3ef189f86567fabfd2134f9f2b59929f76

      SHA256

      e97801d341badf2cd7887de4c0a34a8a3b721c9eee4a3f7ee038f07776ec0821

      SHA512

      ea211198e13004df7842b904c7fd297ef7f278f3e88f8adbb98a06f74a339f36f3efb565b57b0a37d5e4f99f65655ac01f4e20d81311b38cdbb05e92225b82a0

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      4833d7aa8a64137c8ce1b641eb3d1325

      SHA1

      4a8354d70442597d6abaeca8b9407a46a557acb2

      SHA256

      42822de707b66ca50f3c9380f2f6421219a71e7fdf1525e5cf0509fa6c85425f

      SHA512

      0dcfae5fd00febea8a5b8e204b15b9525a5730a84b4aac0676b8a96a14640416585e51998b91efa675ae3956d7b1f4298ef80c9ce48d68867fe63d5710be8c73

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      4ba7bfcae7d5d1577e3b2baac9a0cef5

      SHA1

      05005b981907ddb89f4d9b1c0bde311dcd4a6703

      SHA256

      1e57ae5e5b7ab680533cfabc21137d5efef5c83db274d92a4b1d46f0a89b6ab8

      SHA512

      57bee047eef8f6c99769b372ed2a8678cb6fe0746cd13b90725b6a532a997dae5326d53e10d3550c7fee5c2ab25f12056064b04b2ae964a4d119b268e87c3a60

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d0876f326b26996b5cdde49113d55fe8

      SHA1

      1665a2a095475260aead5ca2b99e922a696e44cb

      SHA256

      9f5e765b576a8414010a9109606d22d825bd92f26c4a950ab0bf5a4364dcae45

      SHA512

      25f274724d12ea498e6470465173840595dd964df48c2ea6d364c0b797399537db2a2a62d503bc99f3dc07bb3696439b01ca58fa3cbbbb4c0be29018210cb752

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      f4009c87890e0c47a22f0a24561f35a5

      SHA1

      8dff4fa8bfe01659680f10f098246101ad3e92c7

      SHA256

      6ebbd3bbdd0a09528213eeec9c46e69977c03778f1a6c7da5da0594a0a92c34b

      SHA512

      877dbd41e98bdf7b299f343af07d3cb65c53c7969ecee9132f070b84041dbc26a67a943ef5e3085f808c784a69735772c8387254ca48103bafd8de2a6608684c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      8b3fd80f42515f16bc1d1f49eecac9ee

      SHA1

      f09e75323cab2d5aa224c0b073d5e633a6c6acd6

      SHA256

      2f420668682ae461948a7cf004ee152c590b02cd375deddcd1c9e5c5c5883c18

      SHA512

      5546b9f462284dd8975ab42138dbbb9ec8059af64901114879867b00bc8017c34f0a2e5c324c6e8c15f69628ce76001e14429b32bfba439ce9d54a5b5c28e6dd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      64171ecc5bb47fcb082592fc982deb27

      SHA1

      60d12059bb79bee336ca5353cb47ae62d2ffc6f8

      SHA256

      a79f73f77e1cc0e5a0e8931c1815c476fab1cad07dac8033cb22897312021e83

      SHA512

      4172e05f52a3a7fcfd57322a3b68a8181152415ef546948f9766998ea5cd3daedd349123c9f0c993e6528b452bcb9af48aeb8a362b755518d06f0b0652845d55

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      6148055334830a09d3087854fbeab819

      SHA1

      2cc3f4cd9943c3ce649e996c1f093481d72de980

      SHA256

      c8ca68729c4c11a4df07900e4305f96203e291292036ea0faf3e2b29f0231c54

      SHA512

      41ce2fffa75be0f59350e572f105be6385462de11355e8034ba84fe37e662a92d34c93beb5bff963cb559d0363c35ed48a0f61f927cfe91f576c71fdd26e95a6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      a0ce8075d2ef6ee98a6d44500b992d1a

      SHA1

      9215bef17bd116f5360f6380644136e34fd52df6

      SHA256

      8fbbf2fc1eff55fcfaef675910df6cb569593617702e9834c19d64ef5099f212

      SHA512

      08b4681753f8dc0017c466139bc597440eb68ecb5fe4a253436780d598f516d15a24b3e13e2f849bd85d8c5bb4c2e1e6e03e29aaf9bd7fa274581236ac953c3c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab2435.tmp
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar2448.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      Download Submit

    • C:\Windows\gfxfutdaqnqm.exe
      Filesize

      384KB

      MD5

      546fe4e8d28a6c67a1047286eb57d773

      SHA1

      19a807a5fe6f1974ea4ba5f2bafb5cf4edb56f23

      SHA256

      828cd60f0928c571477a4e351b0d98d0d03abe48f0b67a9ed605a2eb8dab5c4c

      SHA512

      702ac5cd5e84d6157ab79fc6e41fa4fc1075e72318459345e7e75db200c07d09bf20d7f5b759c53e1207f80d0bbc2f5ab2c464b3cd8c8b8d4ffbc1b32707e5f2

      Download Submit

    • memory/836-17-0x0000000000260000-0x0000000000263000-memory.dmp

      Filesize

      12KB

      Download

    • memory/836-1-0x0000000000260000-0x0000000000263000-memory.dmp

      Filesize

      12KB

      Download

    • memory/836-0-0x0000000000260000-0x0000000000263000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1796-6106-0x0000000000570000-0x0000000000572000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2600-6121-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-6126-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-55-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-54-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-52-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-2360-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-5344-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-6099-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-6105-0x0000000001E90000-0x0000000001E92000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2600-49-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-6109-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-50-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-6123-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2600-971-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-29-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-20-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-19-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-2-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-6-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-4-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-10-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-12-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2604-16-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2604-8-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2640-28-0x0000000000400000-0x0000000000748000-memory.dmp

      Filesize

      3.3MB

      Download