Overview

overview

10

Static

static

10

2024-08-21...er.exe

windows7-x64

10

2024-08-21...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 01:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-21_2b50a6e9c09437dd1a5b17f86410c232_medusalocker.exe

  • Size

    1.2MB

  • MD5

    2b50a6e9c09437dd1a5b17f86410c232

  • SHA1

    e98158c75973fd3166c33029da347d565ca6f3bd

  • SHA256

    1b0afa3285edab717aea40c6213e11a95ea3881173280a63bbda2d254d194217

  • SHA512

    0174063243f8b31bcf7faee05b46b87d095aec248197b5b32a88c016de743aca2231ee683908541da02c72cd72a4400988fe04517937f6049b4e71bb4b666f8f

  • SSDEEP

    12288:zmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXb:qHRFfauvpPXnMKqJtfiOHmUd8QTHL

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note
From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 <p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><span class=3DSpellE><b>=20 <span lang=3DEN-US style=3D'font-size:20.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial;color:#C9211E'>=20 All your valiable data has been encrypted!</span></b></span></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'>=20 <span class=3DSpellE><span lang=3DEN-US style=3D'font-size:13.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 Hello!<BR>Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely.<BR><BR>=20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information.<BR><BR>=20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone.<BR><BR>=20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit.<BR><BR>Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us.<BR></span></span></p><BR><BR><p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><b>=20 <span lang=3DEN-US style=3D'font-size:14.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 If you want to resolve this situation,<BR>please write to ALL of these 2 email addresses:<BR>=20 [email protected]<BR>[email protected]<BR>In subject line please write your ID: 15741359033988283749</span></b></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'><b>=20 <span lang=3DEN-US style=3D'font-family:"Times New Roman","serif";mso-bidi-font-family: Arial;color:#C9211E'>=20 Important!<BR>=20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered.<BR>=20 * Our message may be recognized as spam, so be sure to check the spam folder.<BR>=20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service.<BR>=20 Important<BR>=20 * Please don't waste the time, it will result only additinal damage to your company!<BR>=20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified.<BR>=20 </span></b></p>=20 <BR>=20 </BODY><BR>=20 </HTML>
URLs

http-equiv=3D"X

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (648) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops file in Drivers directory 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 39 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 13 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-21_2b50a6e9c09437dd1a5b17f86410c232_medusalocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-21_2b50a6e9c09437dd1a5b17f86410c232_medusalocker.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3960
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
      2⤵
      • Interacts with shadow copies
      PID:2392
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
      2⤵
      • Interacts with shadow copies
      PID:2936
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2456
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2060
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2396
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1288
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:228
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:884
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2488
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1232
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1516
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2884
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1808
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3744
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1348
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:1344
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:2036
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE >> NUL
      2⤵
        PID:2456
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3868
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
      1⤵
      • Drops file in System32 directory
      PID:4584

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Indicator Removal

    4
    T1070

    File Deletion

    4
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    2
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Windows Credential Manager

    1
    T1555.004

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    4
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348.1btc
      Filesize

      824B

      MD5

      12ea8fbe15e1529d58b4da268152ecd3

      SHA1

      f5770e56bf22bcb64a104d32a2d4b8a4eda1513a

      SHA256

      57166cd89cba8bc77ea484839676269b7cc5a9ce10c4ab0f98709b9ce1fb2b18

      SHA512

      a3f6896b2d37b79cfd7f4aca341b4f606f29ac682a4f7f8ae405cdc6c31f4b1941123c4bf0084f958c3a768effa0c4d6e96baba7e716c25f928652eed5d09e91

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc
      Filesize

      814B

      MD5

      ac5a0d0cb1848a625b328690c837a5bb

      SHA1

      8404066c71c1e4f7035d33a32b59e683368ab246

      SHA256

      d342853f365cdf33cfa0e11e55a34d63ac2c380c3432aa7f136fd90b847a1309

      SHA512

      4227680ca2773dc4c4e0ff99022c0e718cd7fa48a66084c6b5f4729499bfb11febf9d1622070a28185aecd527b01830ce455d09211cbc3f61aa05e4957a41118

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc
      Filesize

      840B

      MD5

      47a82caf58492c89294220c38126d887

      SHA1

      9c0f1c5232dc0bc99a3012cd7f04850ff36840c3

      SHA256

      997f3733dcba21b3468c720cf240552255ac38fad0dc93e23add5c9a00d153e1

      SHA512

      3e9188a7518f5f3adc5569982e3fadd1479f42d6522b097fbffc52519db2ce04df6ebf341dd98e76a93facf41e2940662d972e11c2342628ee8ed56a7b2740b0

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.1btc
      Filesize

      700B

      MD5

      2c81b68aab54e8f6f49a415de9a43aa6

      SHA1

      9706964996a1da993d10f9f37acdf923b6acac45

      SHA256

      9cde5751f542e7d9e93e07857497bfff054d8eaaa6a7f8b20c439a8f6a9acfb1

      SHA512

      2c30d157e8ada2d5a50a058a7f463500b15417e5d6aabb3e8a77fe0036d227eeea256ecc1fa7940328300ebc29ad08c817fb6dc852d809982a09d27cd609bb5b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.1btc
      Filesize

      770B

      MD5

      e46e08186d810bc7c67707f2c3edd555

      SHA1

      abd6d65cc134714ef89cdf79db23957902268b3d

      SHA256

      4014bf47b154363147b612411a29c74baec0fa4925da2afee0a20d8cfda6ee2d

      SHA512

      6fbf371b0a3d856c72a6a8f73e40fc52b97c85d8fb85faf2320fde0d7b15d9aa7c303b7322e2ff371eefe80b303d4d46714342a3b8786172926821d44c7e4cf4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
      Filesize

      290B

      MD5

      7dc723053273c50c099d271bf3fb17a0

      SHA1

      c9ecc8f0e03da233fb2ddea4c44ff8f24759ad4e

      SHA256

      5419f6c2e4e0982c955397ede39ffb6ece5238763884b726b4ad4d0d62183b49

      SHA512

      39f671c3c7ee72e3e9550978039d72e0dc9af162b7dc8b77831f053c17b2c1ea669660fe49ba6e6633db5c1d26ef3275b5cfaa589562e4f76b9767a4a63cfbdd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc
      Filesize

      842B

      MD5

      5b9ab857d49b068ad4e965bf661f2179

      SHA1

      25d245208e1d25c4a0be036ddb0fcbd1a6e01517

      SHA256

      f52add12fb30c9a9a4ac2f67c37f3ee152071acab2edef663933101b1e3576e6

      SHA512

      41e69e2788cf297d5f6720369430bbfc47ab6fbb689e8dba981e8f9819f5392daab89606895500dd154fa665a8571156b450392f13c09346f081df4cb7d95567

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.1btc
      Filesize

      782B

      MD5

      5860e73e4d4172e8b009226d6035611b

      SHA1

      e0a5046360ded450ef84e215533992cbc34aae9e

      SHA256

      ae2b4135c852d13c4346c89176dd242bfa0ade000ce2c52fa7969476f2b28fe0

      SHA512

      599efb550c01fa18a194c8f38fc8eab3bbfa985aac9604ed0afbcd44b32b944fb8547d3be94e875c872e5ec836a55f465edc3c9f62898aafb10a6047eb7909c4

      Download Submit

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      19KB

      MD5

      cc8ffb2019f15d84d89f7aa4087e338e

      SHA1

      752871aceab86effdac2b938e81e4bd92766de9c

      SHA256

      f6ebbdb31360737da7905a7c0dfa7dd10e8b65e28240c0bcbafe650d3200577b

      SHA512

      6aa93adc0849df1c97e5261e090341b0399933e4de5b23e04f9a6b721151b08aab8a44b28eb6447e81a9cec8ac018c406c522c15ba959e4bb75cee958d51fa7d

      Download Submit

    • C:\Windows\System32\catroot2\edb.log
      Filesize

      2.0MB

      MD5

      9746f3e222b030dcc813ce5e2a05ed65

      SHA1

      479e8ce2ae1e45ac4d1a199797ebd12d78ab83bc

      SHA256

      107dcc85947a7007a9b1d04bfa57756072e34164aba7e766b48309cf7e64775d

      SHA512

      13532ddd54c49f7b8bc919986191283c170b2d8232f6e0dcf3e12e504b6695da7039f037237e82761d1e05254f174193d07823f6780240a30b26ffbd735c4298

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc
      Filesize

      850B

      MD5

      8aeb80c5c5371397bd4437114f66e491

      SHA1

      683fc3f5ec87969bd45601473d0ddae46c8ed779

      SHA256

      e9f117b06b72277916f4ee4b73e800dce8124d294d57a3d729bd883d17779fb5

      SHA512

      9f04110149560a7d28aa4a509878804cf3d006861322e863fdb522412b1148d039dd5c0e0a606d2176af467638de5309da22efd8f7cf2c107dc69a1126f5d35b

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc
      Filesize

      802B

      MD5

      0a838abd157a26e1b27759bdf4f8ed7b

      SHA1

      0a6c17868944097ff7c4a16799cbadcb0182735d

      SHA256

      286813b160f4577898a649b3797d901660a1b4323874b30c7f6e2cbfda7efeaf

      SHA512

      c79355119c787633ac51e3f728e9676b85d06c50444984149b3eab22e079853822eb56f59351bbc47c9bd4c90a077deb1141fd2bb1f0ac9cbd9bafe2955a8bbf

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc
      Filesize

      842B

      MD5

      776bb7c34a0f4634b438a16b2b95a6d2

      SHA1

      b2fa612b7b8db0962d98660cac64a08c49db16b5

      SHA256

      d4fec12bdbb8096d6c89be1d3f0c5c926e0580d99a2e6c44246f045b96075858

      SHA512

      02596bdc4333dd37736a78f1c644ea8ac6cfa77d1f9453132eb5b8662cc5fbb936140331386aa30fc88bcdd722be6d6c346eae9f8e77043f927b9891317fc2ce

      Download Submit

    • \Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht
      Filesize

      4KB

      MD5

      d8cf6d542722188785d60e487c3061d6

      SHA1

      4ed090215f1fe14a74ec0050f368b3ea69288f8b

      SHA256

      da25f7dc79519fd53d471f0321a609bb605710e2013868ffaee66736f62b3ad6

      SHA512

      d0426cb15593c7d7782747a3e93f138552387d022333690ccb2a74f04a56a3e610be4d2b33cfab5fc674fec1625c59aa6684cf87a757a47510b0f55892a3c05d

      Download Submit

    • memory/4584-986-0x0000020458B50000-0x0000020458B51000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1112-0x000002045CF00000-0x000002045CF01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-853-0x0000020455C90000-0x0000020455C91000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-865-0x00000204563F0000-0x00000204563F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-866-0x00000204563F0000-0x00000204563F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-873-0x0000020456B40000-0x0000020456B41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-911-0x0000020454AD0000-0x0000020454AD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-912-0x0000020454AD0000-0x0000020454AD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-914-0x0000020454B00000-0x0000020454B01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1021-0x0000020459BB0000-0x0000020459BB1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1049-0x0000020455090000-0x0000020455091000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1048-0x0000020455090000-0x0000020455091000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-841-0x0000020454E50000-0x0000020454E51000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1081-0x000002045ACC0000-0x000002045ACC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1106-0x0000020455170000-0x0000020455171000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1105-0x0000020455170000-0x0000020455171000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1111-0x000002045BE70000-0x000002045BE71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1109-0x0000020455250000-0x0000020455251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1108-0x0000020455250000-0x0000020455251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-844-0x0000020454F80000-0x0000020454F81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1121-0x00000204557C0000-0x00000204557C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1118-0x00000204557C0000-0x00000204557C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1126-0x0000020455AB0000-0x0000020455AB1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1132-0x000002045E5A0000-0x000002045E5A1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1131-0x000002045E5A0000-0x000002045E5A1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1135-0x000002045EBD0000-0x000002045EBD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1138-0x00000204567D0000-0x00000204567D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1137-0x0000020456910000-0x0000020456911000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-1136-0x0000020456910000-0x0000020456911000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-840-0x0000020454E30000-0x0000020454E31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-839-0x0000020454D00000-0x0000020454D01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-837-0x0000020454D00000-0x0000020454D01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-834-0x0000020454C20000-0x0000020454C21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-833-0x0000020454C00000-0x0000020454C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-832-0x0000020454AC0000-0x0000020454AC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-830-0x0000020454AC0000-0x0000020454AC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-808-0x0000020454800000-0x0000020454801000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-800-0x0000020454A20000-0x0000020454A21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4584-791-0x0000020450740000-0x0000020450750000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4584-785-0x000002044FF70000-0x000002044FF80000-memory.dmp

      Filesize

      64KB

      Download