Overview

overview

10

Static

static

3

2b4d5982e3...18.exe

windows7-x64

10

2b4d5982e3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 05:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b4d5982e3909f16967246c9fc4d2451_JaffaCakes118.exe

  • Size

    376KB

  • MD5

    2b4d5982e3909f16967246c9fc4d2451

  • SHA1

    2bd2a2d29679fe8cf68ab8f00ae9ed58f1506c06

  • SHA256

    535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059

  • SHA512

    01d8716520cab4c226135116cc716d5337b54bcfd672fed8ef727b02560ecd1a16c8602bafbdc75fb65eb49f8af9d3add0658c116b9a574fe2183e2f2f9c68cb

  • SSDEEP

    6144:6e3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:6Y5hMfqwTsTKcmTV5kINEx+d

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+igjfx.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9C478A68B158A78 2. http://kkd47eh4hdjshb5t.angortra.at/9C478A68B158A78 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/9C478A68B158A78 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/9C478A68B158A78 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9C478A68B158A78 http://kkd47eh4hdjshb5t.angortra.at/9C478A68B158A78 http://ytrest84y5i456hghadefdsd.pontogrot.com/9C478A68B158A78 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/9C478A68B158A78
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9C478A68B158A78

http://kkd47eh4hdjshb5t.angortra.at/9C478A68B158A78

http://ytrest84y5i456hghadefdsd.pontogrot.com/9C478A68B158A78

http://xlowfznrg4wf7dli.ONION/9C478A68B158A78

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (433) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b4d5982e3909f16967246c9fc4d2451_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2b4d5982e3909f16967246c9fc4d2451_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\2b4d5982e3909f16967246c9fc4d2451_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2b4d5982e3909f16967246c9fc4d2451_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\kefgitgwsscb.exe
        C:\Windows\kefgitgwsscb.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Windows\kefgitgwsscb.exe
          C:\Windows\kefgitgwsscb.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2200
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2888
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2724
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2344
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2B4D59~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2728
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+igjfx.html
    Filesize

    7KB

    MD5

    e80813b80a1a05774209593fddab70fd

    SHA1

    719a9da61776f5c7aded3a822940fdd5e31a0c17

    SHA256

    882663361c48105a035b971e74978276764bdf167b66078ed620ed93f98644fa

    SHA512

    db20a826e0c0e73450852ec09e79424802c337b276b924ff1add98b715e0d3188bb7d5b6777112552cf2c658e7223882bb9ebd5d3d72da80261dc51427120bf6

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+igjfx.png
    Filesize

    63KB

    MD5

    9365c342563bc86f8f21316cf4fa3647

    SHA1

    6c27c864545d4169005c4d1261859401943d6ab0

    SHA256

    ee41dab8a5e5b7c15f8d30e9787cabfb38b8c371c65d4039b7bd5a11cdda2f8f

    SHA512

    8444852ce27b59cdf1dd1d30e01d0b429669edf320296831ddf947d992fa3b56fb278cee3b934ff5ac48aa77c61a05cfa6c2f2be2473eb4748098f89e37d0e8f

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+igjfx.txt
    Filesize

    1KB

    MD5

    7e6b1b5e8f113edb994e26cdede92150

    SHA1

    735ab817b1bead877f4578bfeac581ca9d81addc

    SHA256

    cdbdd3cbd87a919bf7852320f1efcc4043eb3c832215ed6dc18c269c09567138

    SHA512

    149cb4141999acb4413cb033ed7f4d991bbe1e05bdace765026f8d3b9fbcbdc87e183ce1acd39c7bc6ff73c9269b13968a6665ca2e09939c3cef83890be27a8c

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    25ef0d57e5708a2d211e6c9970c1e2d9

    SHA1

    e45552f0a58cb57a565e866f4ef107b746188f32

    SHA256

    1e44097d2d262dc5bb57e7febcb2d3b4f93ad4c318eeb227ec060350f6796bd1

    SHA512

    f52307b7bad167e93dce61daf3692b0d06ccdc215e9b16b3b474044dd1d14d711b6d1d18632685a5f31c33185c6052804cb44ebfc1e7ee78eb0055ad32da01bb

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    ff157fdbbeb445ce8ee72c2e9057fdea

    SHA1

    d9d06c9469d422d42d49c82615e55e482605806f

    SHA256

    cb01566fec248bead8bf429c6df87cef01c8323753c2033b9c45c68ba5780bd2

    SHA512

    13b5130c65ab3081be0eac8a9b1fc54728f359449311dc764090c32feee0284f845bcc41e2f72fa591bf3fc2114b018c692ad8ea2bd11a983d9bd6974a3626d5

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    88df688ac77d349370c594237b26cd1f

    SHA1

    b0c6a9c538fa60c98882636fe8806c9ed7cd2159

    SHA256

    dfa9105172b3e511c0b1f7066f71fc56172d053ea54d7c5e964dd1261d2e704c

    SHA512

    ac8cf2f3519b3c1baa11d6c5cd8370e3eb05ceed31516ee4117b66e1b4becbd1549038b4a0c6b1a7df17e940f2bf58bd135c8f595666559cae19e76f3802d99e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5477a5cf1b08e8a20db6b3d69cc0fd0b

    SHA1

    131ffe8f5998d7f8c2aa8dfafe51bfa3e913e5a7

    SHA256

    78c3da9f6fe2acd2244836238aeff3eeeb04d06e375df175581174f4f6d9ba14

    SHA512

    e364a8f84f0a6a451cef92e90780127af7002ac23b628b7f402796fc87eadeee916345c9689a910f11dd68fed50f17145dfa240e4106fae417fe982527e761d2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    87723bf7a88ad04c799971b34a0bfdf2

    SHA1

    d0361da9454965c5220531877fde519f309a15fd

    SHA256

    d85d36fc3e6b2e7765a310ad054941e24e437d359a308c30dc725de26152d1cf

    SHA512

    9632aac1bc502ecc2153a3c70c56ac1d73a03c040c296e1221b63cc202c284077145144f91755b24465d86e86f5005d7b82d1d4fe88f966a4bcff5e58cd2b678

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f36a13f3dcbb21075dc846e1d26e0f5a

    SHA1

    29e94e80303bfac05f31ff2f490e7bd81f4d95a4

    SHA256

    0f9e478e2d879744a9539fe6bf00674aeb79c84c2e9ab65d00194264c4f682fd

    SHA512

    992198f440de11916849891540e48ae4dddc86f1b3055943071e9147d7ff4beaf039b9aba07e173f69f90b086440a7e52ed07c53feac3289b0444ac3fd425b8b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    160471c07646a26ff2a382b3adae8883

    SHA1

    67768718f30bedeb0071d491df4d0ff78925ba37

    SHA256

    a59236be9e1de0c0c778ff1a8ae0f0c389319ddcc66fe9320e78bbe5898702c2

    SHA512

    70f077f650453e5b9f605e488ca354f7b91ff9dd8d5abcc3014476ce6830a8a2bc8b647b5c81e34ff18c1f0755814227ac0ba2413a30541625fdf999f39dd6a0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1203fe7dea266d094d362ba287ade869

    SHA1

    7d992e5f005dbf9fd8bbada8f536b86a2859a021

    SHA256

    8a059fd481f107dfc24b14fdcb178e5cb481cf5853f5a4cf9c9fdfda47cabdd8

    SHA512

    2def8cacff7eae2e8fd43e93b43d31caade17ffdb056169b2f405ca12c6de2382a06141d1093ef2840740a053c28271670883b903a01cb3b5df9a032da6c8a4d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    cb25ced7a76d06d4228f3b827708668f

    SHA1

    ea21c4a7dc23d17200c25fcec4b7bc44af47e5a9

    SHA256

    30b9f0079a1a921f47a8832ffa437e488da32b36893547a8a6730d4052bf61b6

    SHA512

    ef6e9eb0f82dc473032fe65d9b2920e51bfc65babfe4290fa854a79cf96dcce81b0d1bd0791b318a7530426d752e936267d3f9b769022d1079a1158442a4f28c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9a1fa3bfc60d686bfe4f2d8e5c867636

    SHA1

    94be60fd7271b592357695a96675b3569b8a182e

    SHA256

    0d26309a5d972b9eb2f898933b01cb505bab8b0cf1345954ad866950dbd0db37

    SHA512

    5ef16d144befc75c75d9870ec38be82d0184e6913cc03e5f26ed54e6b332c51126cd60936ceec347f5248d8b9038989cb67ad0e32e1b546f50f0ddc4fb5cc823

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    00190b202c5024aee895baff81a9e62c

    SHA1

    a485f62186d6a00bc59308fb114dfb2892fc21a7

    SHA256

    696eff33d394ba68765767dc55159405ea39122aba0dc38e6a227fae9bd24416

    SHA512

    ce484ae3d9ea90166bc1fbaa907c2ee63e7d7b9600f63a35e13dd41844e76ca4f3f8b24518d6ec156cf3d3810219857f35e805fa9f7276c69ebace3dbf2a1888

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2be89fd48511c6f8bc0dfd065b3ed4c9

    SHA1

    2d55a6b8350e16a8c6f2af6dd1744a76e3493472

    SHA256

    82e72f3caed8763066df2dbdef7facb759c674b251e132cfd2970c75be5f20e3

    SHA512

    437d109404e138cccf51352106fc0042e4dd20feaebe981a4c5c7e6caa62bc46716b193e00ce7eccbe00e04e3b3979deae75cd754b4f4afd8e4d90103299f764

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab2F9B.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar3430.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\kefgitgwsscb.exe
    Filesize

    376KB

    MD5

    2b4d5982e3909f16967246c9fc4d2451

    SHA1

    2bd2a2d29679fe8cf68ab8f00ae9ed58f1506c06

    SHA256

    535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059

    SHA512

    01d8716520cab4c226135116cc716d5337b54bcfd672fed8ef727b02560ecd1a16c8602bafbdc75fb65eb49f8af9d3add0658c116b9a574fe2183e2f2f9c68cb

    Download Submit

  • memory/2200-6130-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-6136-0x0000000004320000-0x0000000004322000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2200-6588-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-6582-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-6583-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-52-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-54-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-4672-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-56-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-1683-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-1687-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-50-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2200-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-4-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-20-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-31-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-10-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2232-16-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-8-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-12-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-18-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-6-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2232-2-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2536-19-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2536-1-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2536-0-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2580-6137-0x0000000000160000-0x0000000000162000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2768-28-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

    Download