Overview

overview

10

Static

static

1

URLScan

urlscan

http://the malware r...

windows10-2004-x64

10

http://the malware r...

windows11-21h2-x64

3

Analysis

  • max time kernel
    278s
  • max time network
    278s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2024 16:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://the malware repo

Score
10/10
dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarestealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 78244D5D In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (627) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://the malware repo
    1⤵
      PID:2196
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=1308,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      1⤵
        PID:468
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3724,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
        1⤵
          PID:1684
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5168,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
          1⤵
            PID:2428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5540,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
            1⤵
              PID:2932
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5572,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
              1⤵
                PID:4124
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5848,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
                1⤵
                  PID:2740
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5400,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
                  1⤵
                    PID:4084
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=4028,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
                    1⤵
                      PID:4000
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5880,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
                      1⤵
                        PID:3436
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=5396,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
                        1⤵
                          PID:2692
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4432,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
                          1⤵
                            PID:4884
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6420,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
                            1⤵
                              PID:2232
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5856,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
                              1⤵
                                PID:2092
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=6780,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
                                1⤵
                                  PID:2972
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6412,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
                                  1⤵
                                    PID:4460
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6480,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
                                    1⤵
                                    • Modifies registry class
                                    PID:1108
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=6452,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
                                    1⤵
                                      PID:392
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=7060,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
                                      1⤵
                                        PID:1620
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=4912,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
                                        1⤵
                                          PID:4544
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5744,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
                                          1⤵
                                            PID:5536
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=5620,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
                                            1⤵
                                              PID:5592
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=6856,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
                                              1⤵
                                                PID:5600
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=6104,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
                                                1⤵
                                                  PID:5812
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7664,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:8
                                                  1⤵
                                                    PID:5968
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=7772,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:8
                                                    1⤵
                                                      PID:5980
                                                    • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                      "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                      1⤵
                                                      • Drops startup file
                                                      • Adds Run key to start application
                                                      • Drops desktop.ini file(s)
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3032
                                                      • C:\Windows\system32\cmd.exe
                                                        "C:\Windows\system32\cmd.exe"
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1936
                                                        • C:\Windows\system32\mode.com
                                                          mode con cp select=1251
                                                          3⤵
                                                            PID:20088
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin delete shadows /all /quiet
                                                            3⤵
                                                            • Interacts with shadow copies
                                                            PID:32636
                                                        • C:\Windows\system32\cmd.exe
                                                          "C:\Windows\system32\cmd.exe"
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:11964
                                                          • C:\Windows\system32\mode.com
                                                            mode con cp select=1251
                                                            3⤵
                                                              PID:12292
                                                            • C:\Windows\system32\vssadmin.exe
                                                              vssadmin delete shadows /all /quiet
                                                              3⤵
                                                              • Interacts with shadow copies
                                                              PID:12324
                                                          • C:\Windows\System32\mshta.exe
                                                            "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                            2⤵
                                                              PID:12036
                                                            • C:\Windows\System32\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                              2⤵
                                                                PID:12052
                                                            • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                              "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3668
                                                            • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                              "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2848
                                                            • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                              "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5276
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:228
                                                              • C:\Windows\system32\vssvc.exe
                                                                C:\Windows\system32\vssvc.exe
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:10528
                                                              • C:\Windows\system32\werfault.exe
                                                                werfault.exe /h /shared Global\987e94b02cce41b59fdb706061797ad3 /t 12040 /p 12036
                                                                1⤵
                                                                  PID:13240
                                                                • C:\Windows\system32\werfault.exe
                                                                  werfault.exe /h /shared Global\192caea12fff4f90ae009719b063e802 /t 12056 /p 12052
                                                                  1⤵
                                                                    PID:2196
                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
                                                                    1⤵
                                                                      PID:13448

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-78244D5D.[[email protected]].ncov
                                                                      Filesize

                                                                      3.2MB

                                                                      MD5

                                                                      30d517b4e51df1b1d2846341b3faef37

                                                                      SHA1

                                                                      68376fb1a1df34778a700da21498e99660f8a2e2

                                                                      SHA256

                                                                      52252219fab2d63476a2532d758e50782bd1dfbcf01c35a6e73aaf33a3a8c63f

                                                                      SHA512

                                                                      e4e9e599b5d482681c4c4bd918b5243b16d3d50121866d8d0966071294309631d5a995b80322ed59450d80eed829041cc01070cab03a9e12d548d03e599e0008

                                                                      Download Submit

                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
                                                                      Filesize

                                                                      13KB

                                                                      MD5

                                                                      44e866ce245148313cc6c0da61f3c6b5

                                                                      SHA1

                                                                      6ff6b90c458048a4fe2dafd57563d3a1faec7941

                                                                      SHA256

                                                                      4396f527ee5e907e66c217ce0450d24e36e9e32982747b4de928159475a62e05

                                                                      SHA512

                                                                      b0b1478505e3b7cb336173f1670b030df3e49faf41994756440c8e8cce86b2e82c61964d3cf6ec1fb48e763d68668b2c1520c041bbb97b64c8284baaf627fa9a

                                                                      Download Submit

                                                                    • C:\Users\Public\Desktop\FILES ENCRYPTED.txt
                                                                      Filesize

                                                                      170B

                                                                      MD5

                                                                      21539971cae3b6278ce678b16b3f2643

                                                                      SHA1

                                                                      f4357280ca6838b0b62e610c6ffc24d1ab615e37

                                                                      SHA256

                                                                      b386715edcdb5fbb762f2308d588c5a67bfe65745105b87228596885e4715045

                                                                      SHA512

                                                                      43f07a7df1bf14f76f60424219f00c051f4097f222f3b453cd208449f30e4915745300ad89f45a738bd828c7691fe97c0a16fa58115057d4ccf0e1784b46a7db

                                                                      Download Submit

                                                                    • memory/2848-5788-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/2848-4786-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/2848-1-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/3032-3-0x000000000ADC0000-0x000000000ADF4000-memory.dmp

                                                                      Filesize

                                                                      208KB

                                                                      Download

                                                                    • memory/3032-4380-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/3032-4-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/3032-0-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/3032-20419-0x000000000ADC0000-0x000000000ADF4000-memory.dmp

                                                                      Filesize

                                                                      208KB

                                                                      Download

                                                                    • memory/3668-5787-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/3668-4755-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/5276-6103-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/5276-7325-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download

                                                                    • memory/5276-2-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                      Download