Overview

overview

10

Static

static

3

VirusShare...99.exe

windows7-x64

10

VirusShare...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 11:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_40707cdcd4220213b9ef2545043d6c99.exe

  • Size

    388KB

  • MD5

    40707cdcd4220213b9ef2545043d6c99

  • SHA1

    7f9d3ad1125de47368644e29b5d5cd515c6497e8

  • SHA256

    6f7c7b4f3bd9e6ce0dc0d4dd7662e35d8a2079dfe61b2febf2645b68fe11ee3f

  • SHA512

    0a3cda582f1a444ad78d5f09d4e204a753c74863bcbbbdf5c6ffcafa523b195ac4c6aa7922973cf2687b673e4e346f94b6525402db7380a4e53c3f8855480088

  • SSDEEP

    6144:tYMk7V7PQkaYO0iNq/PimTBQNEETJYOo0DldfrvwmjcMVW5OouUI5KtrQ8POyU:tnSdO0iNEPn+TGOoYzwscMSOXUIJ

Score
10/10
teslacryptdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iqbsr.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9B913E7578B55386 2. http://kkd47eh4hdjshb5t.angortra.at/9B913E7578B55386 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/9B913E7578B55386 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/9B913E7578B55386 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9B913E7578B55386 http://kkd47eh4hdjshb5t.angortra.at/9B913E7578B55386 http://ytrest84y5i456hghadefdsd.pontogrot.com/9B913E7578B55386 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/9B913E7578B55386
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9B913E7578B55386

http://kkd47eh4hdjshb5t.angortra.at/9B913E7578B55386

http://ytrest84y5i456hghadefdsd.pontogrot.com/9B913E7578B55386

http://xlowfznrg4wf7dli.ONION/9B913E7578B55386

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (424) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_40707cdcd4220213b9ef2545043d6c99.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_40707cdcd4220213b9ef2545043d6c99.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_40707cdcd4220213b9ef2545043d6c99.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_40707cdcd4220213b9ef2545043d6c99.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Windows\uxobpsjaqhdu.exe
        C:\Windows\uxobpsjaqhdu.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\uxobpsjaqhdu.exe
          C:\Windows\uxobpsjaqhdu.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2464
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2312
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:2612
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2280
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2544
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2308
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\UXOBPS~1.EXE
            5⤵
              PID:832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
          3⤵
          • Deletes itself
          PID:2532
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:2444

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iqbsr.html
      Filesize

      9KB

      MD5

      4478b59ab7aa18d21f91ddac54a4daed

      SHA1

      4a4b63738b0bc210a25f40fad36f789610e39a7a

      SHA256

      96c9515ffaf4f57bd00f8f4fec8807b5309c8883d4b8ea66fc7c5db0c9c26ff8

      SHA512

      b22c032c3df34db9c5009322e5ac54abe6ab64f5b2a2f3d4f318a8cb942ed7504b8cf01f27a1b301e129841cfc1eb88197de1652f6cec9617cffaa6fa4eb75ae

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iqbsr.png
      Filesize

      63KB

      MD5

      658314150e079e451a57e851af093e44

      SHA1

      0e8ff603d6fa690faac4a3f32140c011d49c0dc1

      SHA256

      91f5bb01b7a413c3f851d7c5f816d1e80f4198f372515f9c39621930202671d1

      SHA512

      b23ce432765a998d56c0c13250643ada0358892a09a454b84592fa0290b728ea2a42b0f92f4eb2db26d7c3e416abfe5c4fcc2a2d54e0bf6f607041e4730494c4

      Download Submit

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iqbsr.txt
      Filesize

      1KB

      MD5

      6e9b0a34164fa423cf0424b3b30c73d6

      SHA1

      7f2f87e01bf6ad925ccf6fca34b58c6d0d58091e

      SHA256

      4a00a3e06e1097b235b7b8ddeb0bed5059a4df24b6e96bf89d87012197473d65

      SHA512

      ff9468658619040bff5aa6bddc1ec9e2d57238c164d51e6f84a0ee20edc2fa0172eed44f48ea2f5ff729b342747e4976dab1c878684726f16628e2ad16c439fc

      Download Submit

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
      Filesize

      11KB

      MD5

      7b8295923545c7be29e5abcdf24499dc

      SHA1

      97ecdbfe973e03865fd8712f3cbdf73f13ce55dc

      SHA256

      45e02892f014b204ddc75c21fa08fd56ccc6d57769f3db3b3d5161e119ba0782

      SHA512

      34a5d3718bd2793fc17ea556a51bb1b906e13cb18eea0685c8e52144cc4e1935c0fbbbed732d95a00bcd538ee9529c3914c774540714c8aa089be09d8bc2a54a

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
      Filesize

      109KB

      MD5

      3b8cfa77f85ce21930b2353ccba1dc3c

      SHA1

      81396a9f5511072d563400de80b31c2a7aab92e0

      SHA256

      7e92c352615d0346ad0d199bcb4f264ebcc3e9abd4ac2cf050ebcfa5b6f1dac0

      SHA512

      78535a064dd87c04370c39183d1cc8fc8ec1ac0951ff7a6a2a9f51e5e3e5079a4052f3fab9cdd140acb9143ff9140010ee72c7f10ad1975781380141301fd873

      Download Submit

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
      Filesize

      173KB

      MD5

      1292adff9ae479209dd08bb9461eaeb0

      SHA1

      0cac1e5b7f07d2530fd9d86d79b5d25e0faa2348

      SHA256

      96cf0a29f6faf52414766ffd4886176564a9bf05741d70fc6e2ab2cd48f30348

      SHA512

      003ebd4d0094095172b74f645f519f84fc770cc4ffd06e52614b20dfa342b44a36bc23f78d231347f6627dbe97c33aad6b5109e3135d8a268f5a7ddba2a9e408

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ade670ab162d246762213009ec8e6da5

      SHA1

      ba1b5c3ffd9c67f2cec8da72a176005143301fcb

      SHA256

      294d7c6c48ae06deea4c83611236bd46f043b60661cbee3c8f37a0a962dc42fb

      SHA512

      2e2a8270c14beaca4ea327c7588a0754c1812de7f2017e47b43ccd2b52677c49a46ecb12a362d7bcbb83b0b1f3befc6f805fa769aeb7622496c53b66d2ef70bc

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ab78a70b028c762448343b67c5ab69c9

      SHA1

      345187addc6f751c4597ea52b37bd7ddd2bf67a0

      SHA256

      af2a8af50bac276cdb5b50e0ec66b5c068c56baf665c3d337837cdbf6a40884e

      SHA512

      70e127925ecde8322a9cdaae03edad674c746077d5d1652e22b8b122ec6f83d6b6152a8e4480aef38e58b5fc4fa239564015358bd05c4b8ad1e14272294db81a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      eb9673e5432e0e1f130e048fc817cc56

      SHA1

      2a3ec188eabcc19379f60c503cf752ac6afbcf0e

      SHA256

      b431132d60d72fe09ac71087f8dabb743b25ee9dcddadc5dbd1b5bce53bc7b40

      SHA512

      4534031cdee11b850b2e66d9179f3608c58308655d9fb2c39f466a8b247277a554245326d9c31bad6059493db4f865017cae506a6c2c9baed4127dcec77aa06e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      4012203d023a5f6a283aa35d793432b6

      SHA1

      2bd0e7c015304f7168cbe88a573bd1c1dff0a3df

      SHA256

      3b27082147f05426db4ffd5fbae15540147ba0f60583d210abf392112f827305

      SHA512

      7172fdf9d11923a2f2b63039fc6a7d0c25aa2b60c996fe9342d187b464af3e5d5ee11ed6a9c8506c0a2470691b9f9c79b7912699a1b21ff015b70fa69fe0b351

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      674503b89c904db4da8d96a390657a14

      SHA1

      867e6c12eae4d9bffd43e595661a22d4999e8bd6

      SHA256

      37be08807e761dcdeb3249f32bd0faffd3dddd3cc324c16d3f40038e4e4e1f24

      SHA512

      28d1e546144fe8e23dfb7af1633b5560d4df62db8d6bdc86b2b68b0dbe585e158f23192aaecaee55f3cba57ecaad1825bfc7fa4baae98d3c5a9e4aa4328e9280

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      c587fd5bb140e7796c6a85837ebc5d49

      SHA1

      f917d0437532eee952bbf1a4a33aea9bc726ec99

      SHA256

      617af03fcaeefc459e356b7e10635b5b71d25291ad4a338e5f16af21e08e417e

      SHA512

      e3ebb10e0e6f09c59454211f6c187fcf7106cdeece8e7ae6160ed26f3c8eb32c2a814c4176ccb31209636cf396cf0b98163bd7af89a13ed07e07ca9d4cb4f121

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ab373fd6416539c971625ad4f8d670b0

      SHA1

      a8dec1dccf71377a1b77783e889dc6525bc2bc00

      SHA256

      e6e9eb72ed0120862c2564863eb59a8230549dad19449d3c880b193226c4cd23

      SHA512

      5745c8353002308bd60ada84ed8b55fbcdff16a94dce60a08e8b2d6b497120e2be8c3f776e6ee8345d19db9ab54be8bf9631cf6544b31680e38fbcce683dda0e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      974b9f97cbecc91c85720852cf50c8d0

      SHA1

      61dcf304625c2380b9c42e7a28f6747747050ddf

      SHA256

      ceab7e22a0b8529a710b3bc810e3dff264218f9e2c9cb2c0f84ce5d0d6389c25

      SHA512

      10e1dc231210b416cce7249e4444736570cabe33c5d6a37af10dbb68a521c3a8f12dbf8eaeab1e4d634ae7df2a4242fc10c3127f550c324cb63ea34aedeff6e7

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      b7695df4a8e963be981f4e1ac372647c

      SHA1

      e6418abc921211866edb0545befc1207bf2c054a

      SHA256

      81d3d51454f829770603aa9481bb7a9ff7e6940fe5d6e03fd33a7be602ea7c99

      SHA512

      42b9d44f73a83349902078b91a8874edf5456bb73d99936dc3a23d2b51d078662873a1dc92b12015b7fffe2389568d6d73bba080627503f2366046f0beceead5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      02332a2a5a897e8302654469da45eb43

      SHA1

      5ff695f05f742c21e697e1a25c94a3bf5bfbee37

      SHA256

      e4f35bb310d2b4b5c0e7381b65b43351f17fd6b991d670045564f190e035dcfd

      SHA512

      60520f5faf9b2192c80bd0ff961e0e65e98766bd29771b08db2ba547a0a00d86473c8ad9e216569f7accacb8cced30184cde8e63b3c64d83b66068526729ccce

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar1646.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • C:\Windows\uxobpsjaqhdu.exe
      Filesize

      388KB

      MD5

      40707cdcd4220213b9ef2545043d6c99

      SHA1

      7f9d3ad1125de47368644e29b5d5cd515c6497e8

      SHA256

      6f7c7b4f3bd9e6ce0dc0d4dd7662e35d8a2079dfe61b2febf2645b68fe11ee3f

      SHA512

      0a3cda582f1a444ad78d5f09d4e204a753c74863bcbbbdf5c6ffcafa523b195ac4c6aa7922973cf2687b673e4e346f94b6525402db7380a4e53c3f8855480088

      Download Submit

    • memory/2204-18-0x0000000000280000-0x0000000000283000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2204-0-0x0000000000280000-0x0000000000283000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2204-1-0x0000000000280000-0x0000000000283000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2444-6086-0x00000000001B0000-0x00000000001B2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2464-6089-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-2534-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-56-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-52-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-1407-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-51-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-50-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-6115-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-5525-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-6079-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-6112-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-6085-0x0000000000630000-0x0000000000632000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2464-6088-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2464-55-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2512-28-0x0000000000400000-0x000000000085C000-memory.dmp

      Filesize

      4.4MB

      Download

    • memory/2576-31-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-4-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-2-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-6-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-8-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-10-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2576-20-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-19-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-16-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2576-12-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download