Overview

overview

10

Static

static

3

09b5002833...18.exe

windows7-x64

10

09b5002833...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 08:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    09b500283366eafb809963ae3341e9c0_JaffaCakes118.exe

  • Size

    336KB

  • MD5

    09b500283366eafb809963ae3341e9c0

  • SHA1

    628610489c41e78617f4e51d0d0143a07b245f85

  • SHA256

    8506824ad4a9aabf540bbf58741412448178b846e540fbbfdf2a4e48acfe46da

  • SHA512

    7ecb3ed388e2866cbb0331d50d910ce3810f8b9bc1ece963e2cc67c5eaff017d2109e7ccb9d022b8960f78cca243c36bbdb29e0f78fdfc32a78cf2daea6ea796

  • SSDEEP

    6144:r1w0U6D6x4kyjf+g0uc2RTqWmx7Ikw9NShXvSmk2OpXaP/EBySkQ4:ri0Uu6ikyjcuk5y0hXaxpKkB

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+vvaqj.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CA1174AD3B4660F2 2. http://tes543berda73i48fsdfsd.keratadze.at/CA1174AD3B4660F2 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CA1174AD3B4660F2 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/CA1174AD3B4660F2 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CA1174AD3B4660F2 http://tes543berda73i48fsdfsd.keratadze.at/CA1174AD3B4660F2 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CA1174AD3B4660F2 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/CA1174AD3B4660F2
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CA1174AD3B4660F2

http://tes543berda73i48fsdfsd.keratadze.at/CA1174AD3B4660F2

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CA1174AD3B4660F2

http://xlowfznrg4wf7dli.ONION/CA1174AD3B4660F2

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (431) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\09b500283366eafb809963ae3341e9c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\09b500283366eafb809963ae3341e9c0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\09b500283366eafb809963ae3341e9c0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\09b500283366eafb809963ae3341e9c0_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\aujdltalnccs.exe
        C:\Windows\aujdltalnccs.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\aujdltalnccs.exe
          C:\Windows\aujdltalnccs.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2652
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:320
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2476
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2420
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AUJDLT~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\09B500~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2888
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2572
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+vvaqj.html
    Filesize

    11KB

    MD5

    2a2c21cbe3deea17c3f236f583c30cec

    SHA1

    ce9644e6a6d24d0594a874408f1b28a82f3b9550

    SHA256

    feafb9b48e66d853a62dd228fe9359db09d01c5fbc63b86558c44e453f3c76c6

    SHA512

    11f22d2e278001b39fb92384f51f6bfd865b71bb02bb2bc22a8d07780e17c37bd02a205c1e0474984b889768dfc266acda8cb4e5bbecad274c8034a79a197234

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+vvaqj.png
    Filesize

    63KB

    MD5

    aaf1727cc332755ddae352c12517810f

    SHA1

    2680adbfd40ce5977ed72908c2a2786021c0dda0

    SHA256

    1779f6afceff323ba8322ae93568219dd3c478a4296b869b871fcdf40828b531

    SHA512

    761589111858febd16b31a509f4230d20ef630f9ed3c42e8afe462c1c70617fbd698915a6aae2ff3ef90526ef343648a2b5a15d0539889ffd19eb03e5dd82c4e

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+vvaqj.txt
    Filesize

    1KB

    MD5

    f2d138f4cda19a8ce249634975e5534f

    SHA1

    db2bccd09dd1ec8c9f6721dd205b9e3bc03cee83

    SHA256

    9ae2661f59e66a6ba4293b43be112463bcc549ac94ff63621cc39ccfc81ee761

    SHA512

    76ec4280cff34263d22d64163e75c0003ecea70f4699674eb98b2d1937e7027bb3acaf4cc473ca7a7a8f9f2442de1fb81d6fb71991c72163f63e68e19e7ccbcc

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    65b2b942baedb6bf409590b04b8de295

    SHA1

    5b49127794facaab9993869224f8f43bfcd3073f

    SHA256

    e8217629f82c7c516482a230d22dd7a2cce8ce04a49cc9fce63afe2bd99739da

    SHA512

    8a8d2a1d7d3c3ea467c96c044380eba0ab6626e989a54a68421067874d6dfecd3d17195e0674931b53d386bb2d11341ac04b6525b2be943e5b2a6a03a477197c

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    f8111e668c123af636b9d78da4ca76ca

    SHA1

    c1758630970291e07bbadcea4f0a543b82d24913

    SHA256

    39e0ff1cd151b519e4c1c0e093e34c8d88bdf1d6e37429782af4f975e6cdb499

    SHA512

    88547d9cf65f8e0e7542bd407d619dec1d378e96eb954df49a7dcf408379d35e05ba8b6b55ba831c3dff664d7716e9c34f169f3202f645f80ce865c0e414181f

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    0e52b2962c2a054e5cd9981a40ae7a3d

    SHA1

    e7ce55b1035a46ed5b7c5245fdc6eb1ba0dc6db4

    SHA256

    fba05bef3df2b8be22087849306afc65fc3b1f600b9c312f65620da51cf98225

    SHA512

    24237ef136ea2906cd382fae770a13d13b69a27bc229d89c18f95028c2b40d1cac49e1d3affe7352e8bf85350bcb2c66754bf103e878a81f0e439f9e3ac1cc98

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4dd1f090a1680bb0e9d54abf81416d05

    SHA1

    e7fe1d5c0045c2455838469b95b7b56c1fab38a2

    SHA256

    9e3c8635ac04b3a7053088f22a4d7ced772e5e6c37a020df51bd63018d85ba0a

    SHA512

    4658de4ddf8473f259481139787ba35e6ddcd9847983f1093c0fe1aade68850f83c37ff647b34e7dc010982265c82199e6c4ccef8d481e45bf24af18300e7736

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0e0d6a898b4481a91a43f601fed324e2

    SHA1

    f8e070925746cb482a150048581caa99640207e7

    SHA256

    5a1e4655dfd0360bb1e2292e4bc27a9c55964c34ec1db8fe07ed11a6237a7824

    SHA512

    a2d43c7d504223c1a301a43dd037419cb0166389322c2de63add78949852ed8fb975b32dae3142f05ed6c06ee3b960d2dae2d8f9359766894f8aa340f484f26e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    246e7b521524c364ac5c4395a0572d09

    SHA1

    2e0d9d7cf4e6e1756cc41fb6d99019669a5c7d68

    SHA256

    803b37d78b972c1f002e23fe8470c5c23d9fddc68bf2dbffef6a9610a608c710

    SHA512

    efb3a97824723841ed777e1fbb25fc968d72b66e47368cbff4986ce5fc653b4cd7a2fa336f4fbdd08e57c9b420b6ee6c0474e43bbdecca238d751c470dbe5688

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f54c7c71032b706ca43c5c319a1668c6

    SHA1

    ad96f5fc40a186a08699886c1e76a036ea587a00

    SHA256

    e7278222f60c2cfb45e89a6f3ccd00e333faac603700054b43a4b7a8c9797f1f

    SHA512

    35a3ab2b0660605df0d73493ab8d0eefa0630c74527cdbdcbf7097b5b887e8ebeb5f94809ac7189da1c567713d008895adac201491b8231a78dd6516394def8c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    64abf2c0f215d49063656d3161610ee5

    SHA1

    2106d45743973fc663299c27532cd8cdb8b431f5

    SHA256

    b64cf48fadd4fbbfd00f0cf20fcc6875ff60d8163b29359dfd283c27c2efcc4e

    SHA512

    4d93de0535cab180408bbab8a8e3e305b64590e30deb6aa9f1e2bc82ef73a91b877ce74fdbf490a2bd9f46896add46918575be95db91e1b65b3120a234d53fb7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8d31dbe7e92e75536acf34760002bd8a

    SHA1

    468213450f79d38dec03fe8b1a16c18295f31d3f

    SHA256

    17848daccd44686898431074d1aae9cfea94a446f64332e51653f4c6132d1820

    SHA512

    5596a1d2d4757657a11fce85a1b8a94863b1f0dd219737cbc2b164f38b7ce825e4300044b35624c64bb09005b14caeee9b892c389a11c6e71ffa497ea82b4adf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b68eb11f436b4931356d3ceb2c4d049b

    SHA1

    06a5c2d8e9871138b43e74af6a3f95eceac2a75e

    SHA256

    b0204cf388dde99068e34e3b760d6d56148c3b10321305f802624ec51850917b

    SHA512

    1cea9545ae8eb7230d124374d74e30b899ee4ed3d689e50fa60795cfc49f2d93e6a349dbdf3fa6a420c904a67ef3e5885adeffa22d1cf4dba798c701d62a39f4

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5591549c424a41b5d170e3c32438b4da

    SHA1

    399581b68e195c017606eb8f430b827fcaf2364e

    SHA256

    11c987b327c658981b7e169be7ade837fa45521373e07d96b16fef356f9145b3

    SHA512

    467e621a4ec165c3b496a3fc976dd09043f380ae357809de265e35ab7da24e14a11d2fe6545496624950b27e79af21a05c432be7be971845f371b652c5f784fe

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b7dff266abca4fa8f38eb20b4618c907

    SHA1

    fa46bf702e91d69267493a27a7b5ef32d245fc14

    SHA256

    2e1df470ee4e35e9978b098150d427d7d9ad406feae29aca677cc4e6ea637e01

    SHA512

    e5c8879bead0240951ba515e5c210b985454c8ddea4a93d751aa430f6933ec615faf5b77397d3cd6a51522aae35b527963a3eac5cdcdf3ecd956531bd94ed00a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabF11.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarF91.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\aujdltalnccs.exe
    Filesize

    336KB

    MD5

    09b500283366eafb809963ae3341e9c0

    SHA1

    628610489c41e78617f4e51d0d0143a07b245f85

    SHA256

    8506824ad4a9aabf540bbf58741412448178b846e540fbbfdf2a4e48acfe46da

    SHA512

    7ecb3ed388e2866cbb0331d50d910ce3810f8b9bc1ece963e2cc67c5eaff017d2109e7ccb9d022b8960f78cca243c36bbdb29e0f78fdfc32a78cf2daea6ea796

    Download Submit

  • memory/1984-0-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1984-16-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2652-49-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-5275-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6577-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6574-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6570-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-1829-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-1834-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-45-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6113-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6119-0x0000000004560000-0x0000000004562000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2652-6566-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-6565-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-46-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2652-47-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-17-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-5-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-28-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-3-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-9-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-15-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-7-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-1-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2696-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2696-13-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2756-25-0x0000000000400000-0x0000000000748000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2824-6120-0x0000000000220000-0x0000000000222000-memory.dmp

    Filesize

    8KB

    Download