Overview

overview

10

Static

static

3

e5dff6da6b...18.exe

windows7-x64

10

e5dff6da6b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 02:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5dff6da6b5ad6933a59d7d62ff9c699_JaffaCakes118.exe

  • Size

    374KB

  • MD5

    e5dff6da6b5ad6933a59d7d62ff9c699

  • SHA1

    9144d2847e93495c362bb01955a8da325288f453

  • SHA256

    622bc8d9051a4d3cbbde029199aa1c4e0f376185d5c43645c187b344b458eefc

  • SHA512

    cc47e1ea5361ea960c18893179aa6f7f2e776dcdd6923fa313cce1705f32831c5d1acb0c0be916516c03347b65a5ae6f50ec336c15ecc56fb8c14e1a9d96a857

  • SSDEEP

    6144:Wcs0ZKB8pufhYHAk5Ey8FGilhdUYcV0RFJ+WV:Wcs0ZKipufhcumKhdbfES

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+blixq.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://yyre45dbvn2nhbefbmh.begumvelic.at/EF96E617E4228D5 2. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/EF96E617E4228D5 3. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EF96E617E4228D5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/EF96E617E4228D5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://yyre45dbvn2nhbefbmh.begumvelic.at/EF96E617E4228D5 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/EF96E617E4228D5 http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EF96E617E4228D5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/EF96E617E4228D5
URLs

http://yyre45dbvn2nhbefbmh.begumvelic.at/EF96E617E4228D5

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/EF96E617E4228D5

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EF96E617E4228D5

http://xlowfznrg4wf7dli.ONION/EF96E617E4228D5

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (428) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5dff6da6b5ad6933a59d7d62ff9c699_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e5dff6da6b5ad6933a59d7d62ff9c699_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\e5dff6da6b5ad6933a59d7d62ff9c699_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e5dff6da6b5ad6933a59d7d62ff9c699_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\uwxecumjvnnp.exe
        C:\Windows\uwxecumjvnnp.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\uwxecumjvnnp.exe
          C:\Windows\uwxecumjvnnp.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:544
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:288
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:1036
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2340
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2440
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\UWXECU~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2432
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\E5DFF6~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2760
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1744
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+blixq.html
    Filesize

    10KB

    MD5

    500423fdf11658dc9b8b8394e543f742

    SHA1

    be6002e4aa7fc2037f78ead51f52a6b4484fffb9

    SHA256

    c06367cf48bd97f8babfb40d636e2cb128a3fa3158a096107128582d8ba5906e

    SHA512

    1b1f346561877d7a74cb4fc5b45410e365583122ea9e40b564f013e4a19fea64c3372b4963ac8bc79d8a5d4526335347ae4eb0e442c1afe86be217848863474c

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+blixq.png
    Filesize

    63KB

    MD5

    c922164268bf76ee4445a2fc3a984d43

    SHA1

    2560c87d49970cc534b8798f0b619eae125a9ef4

    SHA256

    64705b2c4d88f80afcafd565b2c4172133c1e4b133e870be4b87b1b25c0fb530

    SHA512

    76aaf85e6e0aa540e532537c4c2d53010c37e476aba9182ec66dffc21f35883a6d1be0e1ab56896aed71fed57ca1f907a1ba162b0fb0bcaa48bbb4de9749d46d

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+blixq.txt
    Filesize

    1KB

    MD5

    03a0c236d636c3738ee582fb3b321559

    SHA1

    a4d7f5d2874c5b988887743941cae38ba7fcb279

    SHA256

    ccc7b2b4d107c410ee18f0d2d052c35bc769249eff0fbad3eaee4bae87a9b929

    SHA512

    dc330ccb9d4d9e47f421feb6cb330a6c44526b6661f4e6dc2df67ffada34f8de818b5b4a4fcf2ebe3f003620d59464e783cd7a91fccad550e30acee6a4232021

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    1a7da782310e213b4f36576805c0227d

    SHA1

    37d06fb5832833c2c6257cebcb6e20f972950d6f

    SHA256

    c9919b1c6872e100227e193cd9071cba6cd04a96e1d0996109359bd670be8ea4

    SHA512

    e1671575cf4ed9fc6bb2836662c241cd941cd41118e8411a8cfc6de986a624d1662bd2ef4fc16f5f946ae2af42bacfb30ba3652f113b69aae2017ad29df7ec63

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    1ce20a3c7a3575f11f568981e83ebff0

    SHA1

    7b577dc1fe8354d49bdb2ef349a09464386bd3ad

    SHA256

    025160954c05e815e62295a314819001e594a829b8c04e69a5cc4f1e00ab62b8

    SHA512

    a3bbf17e624966d6d532330387a3322d66139a38ceca5cd81ce586eab63718fa33bc50cbdf7f3361da5847e36f22c048038a5333c7db03da7dbeb1d714fe49a7

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    ed34a620de6a922bd126c6fe55b238e0

    SHA1

    ac1ce0208adfefe08e006c405ba6f6760b738470

    SHA256

    fe1e341861dd6183792474eda028983cab8345503d4f1557bd0c524805dc2a6d

    SHA512

    d6972dbd46440fae65b98bd476a83a11da48f919f359c46a48f68873cdb020d284a9ab99c15e839e32a0ef80f051349f54fe8d2ddbab523867d61e0767703523

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    90f7d16c3287dcdf3020bb369e815181

    SHA1

    af94f4751ebec68428f2d66a10ce9d220b3d1c0f

    SHA256

    67926960df59f112c0e401aa24c92103aa372cd7b6b7316041dc144e0a0c4af6

    SHA512

    d857479aa9fe4e3c36608b08f2e427ca9a0bd7474a696a49154effe3b0493ecf962c16ff868448e682c06d6a6a1388a9c228ecc2603036382e2cd9c9475f1f3f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f55290970f6deb0004c2edf1fa3241b6

    SHA1

    2912640c6a48a63775f18aed008a89f58fd4561c

    SHA256

    c327ca341fc887a578b2c1d5ab6d3b8dc829c12f7a4ebea79c17fbde91280469

    SHA512

    525e5e79019f980f91abde7ed28715fc7fe9e6b8abfe8bc4fd552ce1a1f22395cc8ed14219eb0a3c328b7f6b8cbd4c2adfb17c48fb393899573f140849c34c85

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    7e1cee7ccb6d12371b554f1f62a9c28b

    SHA1

    7e82c6b92af6fb445075bc1853773165ddb1fd4a

    SHA256

    e444c48f9d343e03e39017dfdf0ae3fce4502d379ea87aaad9f105693d65158b

    SHA512

    17e06b4773bbfbe1f67934b91366c057ae39cbde484c0ddad610cb32f46aa638178922c0d2501d896f98cf5bfaa56526b62db604106ad45d49acaede7fe6bcc1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a09eec903f0c0ae9a262b1c39b28f390

    SHA1

    ce189b33abfe2bf8b89b379744d4e4d874e7066d

    SHA256

    7a7873e9247ae5fea9bd55cbb82fa5db5868cb093ec39aed823bf1a9f5a3279c

    SHA512

    c6e1eb912f37e98f6280ef642dd3406373ed3b24155ac8ff597569ffe27e7eda4ebe217c518582bde85d5bbae7076eecb5d13b0ea1dc0e145cd3c48905e2f47d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8a42235688d696712faf02c1c859abb9

    SHA1

    d512b683c8cd448646d8b2c8aea4d835480a7f71

    SHA256

    f24b1012d6373c789a7062e8efa6dce75ef06aa4b6066da1e0f674f85f08014d

    SHA512

    002100e93fbe3aadb858918df6e9aa59c347bd25722d32adbd26744e04ef5690f69f39cf93947a52156a5df67466952fc65598a9fb944c02cff38cd2620fa5af

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e760fa5057dffa4c7582e0dfa80b3988

    SHA1

    9abff688708dee82cd5cd869ecf18687dc0bc8d2

    SHA256

    820a727ea8cfc98a7141759580c4fdfc29f6871dc3feb9b6b435ab288e5a7b19

    SHA512

    d87d212ed1158221507a74c4605d9870c0774c69247823c03b7b17a49672859652aa3ec1d62fadf898551c4d26a7723d4778afaf2592b3d4bbc4a079e04f224e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    208a0636bf8235ff3c85301a7cbf6a63

    SHA1

    910bd616bc836b41994c1fd2036fc8aceea94b3a

    SHA256

    6e9db8e51b2b07650ec4aed5d5ecb5e934691ba044ad3c8fc39059b1095a792d

    SHA512

    5fd210514c9620d7675773215bb346856ad4b5249c55e001b1433c8a4413b58c4a8de03adaa072ff78471b9d4d906c42fc93ca497e1aa27275245cab5f80fd4b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    cb83399022953a1ecced161f1811e9f3

    SHA1

    4153ce7cd765304f5209b2b6c5e1dda2b984f611

    SHA256

    77c0a0a3ac2dd42b47e3df8a5230b7add4655d7fd0f12065b6fd3f53bb32d24f

    SHA512

    b3fe47cd530bb6b3ac199dc25dc6b279ba57625a836889b304defa5b622a0f91e178c836714cd3db91387d4c6c6b483c914ad61f281846ebd8df81591135cd10

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    aa9427fd63262c638644e6c3f452edbb

    SHA1

    0e758561086410e62cc0e434db6aca1afc6692ad

    SHA256

    806e55cdfb34854908cc95b3663c2377119a0c99885b5910cee7141067fc1173

    SHA512

    0afccef2f848e71e77e2793aa723b67b95996a4b449bb6f6c54fba6cb55b93fa4b53b02b3f571e00d4613b62fdad0ed5e7f5c41b11484dda3b96589cbec38fc9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabED5E.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarEDDE.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\uwxecumjvnnp.exe
    Filesize

    374KB

    MD5

    e5dff6da6b5ad6933a59d7d62ff9c699

    SHA1

    9144d2847e93495c362bb01955a8da325288f453

    SHA256

    622bc8d9051a4d3cbbde029199aa1c4e0f376185d5c43645c187b344b458eefc

    SHA512

    cc47e1ea5361ea960c18893179aa6f7f2e776dcdd6923fa313cce1705f32831c5d1acb0c0be916516c03347b65a5ae6f50ec336c15ecc56fb8c14e1a9d96a857

    Download Submit

  • memory/544-6120-0x0000000001FA0000-0x0000000001FA2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/544-3394-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-6123-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-6570-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-45-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-6567-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-2065-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-2061-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-6114-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-5614-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-49-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-47-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-6428-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/544-46-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2056-6121-0x00000000000F0000-0x00000000000F2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2532-14-0x0000000000300000-0x0000000000303000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2532-0-0x0000000000300000-0x0000000000303000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2808-5-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-13-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-17-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-16-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2808-3-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-9-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-1-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-7-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2808-28-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2852-25-0x0000000000400000-0x00000000006CA000-memory.dmp

    Filesize

    2.8MB

    Download