Overview

overview

10

Static

static

3

4eb96c4de5...18.exe

windows7-x64

10

4eb96c4de5...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 19:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4eb96c4de5d7f7f9c600c565eb169d4a_JaffaCakes118.exe

  • Size

    241KB

  • MD5

    4eb96c4de5d7f7f9c600c565eb169d4a

  • SHA1

    3851e8d3a83e3ae0e25003b91fc91b9d908cc512

  • SHA256

    b8bfe6d99aefb50a8918788e51a1bc19d06479ed674df5db07e8cf318a9c09ea

  • SHA512

    75b9b6e2c46c4ec3c547d60fc9d85e0749827eafe112f1c0f44144e7f8a851f8fb33fb53fd7438427aa10edb9caf4c2ed5b6fffa57758637dc6597854a203ab1

  • SSDEEP

    6144:kL9h7YTJUQR+xHFGO1/Fc/+1+RF5boHp9U5+OYCy4H:i/Y6QR+7GS/Mq+RF9oHHU5ACy4H

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+frhwm.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/386FABB516D380F7 2. http://tes543berda73i48fsdfsd.keratadze.at/386FABB516D380F7 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/386FABB516D380F7 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/386FABB516D380F7 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/386FABB516D380F7 http://tes543berda73i48fsdfsd.keratadze.at/386FABB516D380F7 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/386FABB516D380F7 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/386FABB516D380F7
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/386FABB516D380F7

http://tes543berda73i48fsdfsd.keratadze.at/386FABB516D380F7

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/386FABB516D380F7

http://xlowfznrg4wf7dli.ONION/386FABB516D380F7

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (420) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eb96c4de5d7f7f9c600c565eb169d4a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4eb96c4de5d7f7f9c600c565eb169d4a_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\sfkqpeehapwp.exe
      C:\Windows\sfkqpeehapwp.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2624
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:2548
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2764
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SFKQPE~1.EXE
        3⤵
        • System Location Discovery: System Language Discovery
        PID:856
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4EB96C~1.EXE
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2528
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2732
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+frhwm.html
    Filesize

    11KB

    MD5

    37674bc6d48bb8aab61bb04d63b3d2a7

    SHA1

    b09ede1369a34dd721a0ed144538a3aa553d3fc5

    SHA256

    f3325e25ed785221ee96352acddd382f74ef4410302f556eb7721f03ce6a1ef1

    SHA512

    223874db4dce3a7691f9899175998533e73e287968cfbad6af872c47b4ad5a5b19670d4c1980736d82eb9679df1ec30668161e6b6722094dfb5c3994a7d0b33e

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+frhwm.png
    Filesize

    62KB

    MD5

    c8e4e387486b9d6d6eccde29df8860df

    SHA1

    b15c1d035cbf7daefe13fe4c93b5084d6b32bdeb

    SHA256

    47793962d404803632c76650b249da73044cfb43dc738317488570a8de56cd66

    SHA512

    ec52e8228f7c000c30a2b958a416cbf70b06c38d642f1da3c815d962756669bf8d83cf9a4178fa60ebe3ff518737b749424581c8297a9b4a4da9f5947a881e39

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+frhwm.txt
    Filesize

    1KB

    MD5

    af895109d915b2a150773976828a41af

    SHA1

    a4ed6b9d9476f7d0a3c6b8a5115e116599fce491

    SHA256

    598a3f4a98798e3728a48d7a4541204970983ffbc2a9f0fd69ec8dad9ffb7078

    SHA512

    68fea2fec0ee8da9e901af2362ccc8a768372e48ce4e328b1095f1f23a82945837ee274dfc1af3306814d1af7ad5fca2fdf7c4237c936d4c2cea9673f8db089f

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    a187c9c4fffaa7ca60a5d373d547da00

    SHA1

    c3bff2eb6024ee2e39ec3afd2a021b603b738da0

    SHA256

    52482a35826a1af391c424d009b3e44f959c32e1299892168fbe65db72e14461

    SHA512

    feef478998dd7d4a0e47a7e4f84458e4834f90a9f81143d0a56901c92097515e3118c7c3c3a1566995ee35dd7ef580be626729527410e97e3fc5f90719b81d16

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    7a6d8d973bb0b6203166612cedc52705

    SHA1

    6f367dd1cd1347f037b203d5ad060cd4692d6c50

    SHA256

    25616b89d3cd6db39319662f25c11ad51470586ec71cb5432d6c04a49ef8c849

    SHA512

    5d84aa496704c4d48e5a5362716c603d763cf97f0cab9fb701a186e5daba1765a99a2948a18f89d6af30fd8d5e7698f320d53908b5cffb6c306760310719e33c

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    01153d68e544882a7172fecdd5fbc508

    SHA1

    9a7c62950e939084e101b05808c0c79ebfaa89b1

    SHA256

    e078a6d0092421febb11a71b715d488aeefa9b613bcb8b3356662e3c68dc5b7d

    SHA512

    29e44b3f06369a5ae9c41718d9f1fd157f9e521868fb865b934780d92b4a3ef570c4b01a374d69ef7e5c047eec3c67b38e846ebd684245338b7309bab5f64eed

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f78356bd907ac424ad9158a095531e3e

    SHA1

    41c41b720793df3d4d7acae838da293691fbf8f2

    SHA256

    49c65fa2e02b2e2287e72c2d4e44bd03a3f4f8efc8745633c7ba7e0b30296c4e

    SHA512

    554d7e72b4ddc84bce665fcca0b410e84f51e9d6d0279808f39938adc29419111342f304388b7320637b0aa2b903f9e7b8af91e0a08d0409a850a7072285795d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a4766b3eb6b1b51c47c904577ef11e84

    SHA1

    4d5a0886ded80dc812d3791299a71c1406456ec5

    SHA256

    eb5c9cc64fd46ee1ac151b0f380cc18a25d167b785c48e26c282212da6556640

    SHA512

    4c9c84658e0f94e23af943fa343f97bd24e1038bb4cb1a37788016e0bf5dde4054f50a2cc15714b6b29c045e25dbeb2c84e65a7b6435addbebe820fd2b2ea4db

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    6cf8938084fa5bdd1201b6025363f9d4

    SHA1

    ddb8732916896dd601a8785fd27441fc25b1f3cc

    SHA256

    da8f6662b0f5bffee145d6fe9e219f2b483ec6e8b8c6c29fa407f2433cb53b62

    SHA512

    17ae6ca30067b7effb688b66f64c83f1be0a438bd3784d0332a8d4fa603ed67bdbdbf56a7f8be3183beb286ffb6cce8842c0a360bda8fd4d569e0de606e71ba8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5ccf823b5c276356be7054b29b558247

    SHA1

    5b60bba2d57b12b476df8d70fbe1ff42dff8e200

    SHA256

    7faf24aee80f0775a87fbb494517f2238750bc80383a7e79d6bb3da91e04b417

    SHA512

    5223ac038b7e58ff74ab7255d17a38da4c1fb96a4d47daa1c17e86e0dda44d1df6481332d8de6bebb0160183fdd1d8b9d8dd86ad563fdc8a9c93f1ad22944c41

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d5218c4dbe17a3e29952ce6587c11f36

    SHA1

    b8031e7cc23ed0bcc0e569f779581e5cd6213581

    SHA256

    908471e750b9a16a8dd084fa34b31481ac8c2b5d9398c11b7345645d1d575167

    SHA512

    fbdb09d646c99af25b2b68feb5911a3fe363cc3939647ce0ee1dec17ec6372c4989af4c8dd77a5bee58c1a06dda5633326688b65d5bb7cfad005218f4c167ba4

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    85ea9af408aeaadae95152e3ca3a6c21

    SHA1

    b9da68d067152bf101e175f61f2256382c88b31a

    SHA256

    88d3d9b696c22a1c45f71241a509d4c9cdf4f310a89b5a1867434866e271b72f

    SHA512

    ad3e876c6de09225b1c42a9a6cccf5500ff4d6c835d65db6a82ca2b74cf9094eada5eba6eef1eef619b6e2b261707e175c3fbbb3523a7afd2a6a283f3a6a8fa9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b4c00377962a4e86de3775b468815211

    SHA1

    051ce84c4028d081ef3e9ec036e30b5c134aa748

    SHA256

    34a371000f4ff1f9ae9a5ee8b12d8ca213fa340538c0ab4e6cd9c1a5ab00ce4e

    SHA512

    1244285b19cf3eee49aae7fb67391186ef21a76f2261b8e0a1836566b313d7902ffc08d40315f5b247ac76999f3d6c644d3b46c8a5a976d112f45abc432e6aaf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f988d8d545de22ef0a93dd2da1aafb64

    SHA1

    ef5c8e69049297525c09dad7ecf5c59d87b25630

    SHA256

    1af44c7ca5cd306500f21908ddf3ee3f877cbf240bdeb4726a41acc0c5929a02

    SHA512

    db7e7c7a1bcb5846ef7ae214655b729e0b38964d15c0f71f6894d45d53749eec254ed62296ce9809e0ded9076e9412f08ce14de4c01c938bd479e132074aab69

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9a876cfdf60757711dc06d595eca10ff

    SHA1

    fdf30a5683cbdf3926d6253563f4ddad74e9ddee

    SHA256

    c350e335a7eb9c499e905a346e6d796c7a39dbe2db34fd5b5c9c7a87cefdce8d

    SHA512

    012de81a961437357ab31eef119f57f4962c23a0c624c9e428f7f37d8866ebaca949967bf300a63ae23d5bbb0670a4a0f966ebebbb73efdde53ae3a16378d919

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c9048e95155df9114cdce8546d12f8ab

    SHA1

    4e71c5d2b784352f667361494f6be652c51cf773

    SHA256

    56f5ebf7968538a9a494aefd1d0e284bae6d2a0e1b91bb249e9627ebe53cb5d4

    SHA512

    cd94f7da4b110148be7adda7c0c9697398462628ef4fa3ce19f3013a1413b1b4978e6a4719b0196c412842b21493101d2cb5c239bc14622f5c594221fe2e484b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    606f1fbd3d097fc46cb946015f5ff876

    SHA1

    91a9a43ba0239e10adc1d9478462e2865eefa6f2

    SHA256

    375dda1a8ce4cb1bb4b0edf87803f90c60abc5164bae25fb66f307507004cd5a

    SHA512

    d7e2ad5a431b4c1685137a8e297d2a22625e8bd5f250fb18e06a2f52157fdc4515b1b817e301e27e2bb9606608c391b4e1af0817b0d61be3e07e519e6521f7ff

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a7a99e2987e1f78c63c5840fecac0653

    SHA1

    e57be9f0806885cfc2cd2f9b8d14084df5596320

    SHA256

    5e4cf2f54e58c013a573768a08b4c058ad8adf83218a7164c639e16b2c1ca5bb

    SHA512

    7165b4dbd7db85cbd9058290010a6aefe69b53246cd944560cbebb4e96c60738a1d970419fcbfb6c80d74cc501c4fdb13a2ed14d24762e858c840cd927c05ced

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab4B75.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar4B87.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\sfkqpeehapwp.exe
    Filesize

    241KB

    MD5

    4eb96c4de5d7f7f9c600c565eb169d4a

    SHA1

    3851e8d3a83e3ae0e25003b91fc91b9d908cc512

    SHA256

    b8bfe6d99aefb50a8918788e51a1bc19d06479ed674df5db07e8cf318a9c09ea

    SHA512

    75b9b6e2c46c4ec3c547d60fc9d85e0749827eafe112f1c0f44144e7f8a851f8fb33fb53fd7438427aa10edb9caf4c2ed5b6fffa57758637dc6597854a203ab1

    Download Submit

  • memory/1712-0-0x00000000003A0000-0x00000000003CE000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1712-2-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1712-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1712-9-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1712-8-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-6078-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-6067-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-6062-0x0000000002D80000-0x0000000002D82000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2624-4329-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-10-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-1479-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2624-1202-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download

  • memory/2928-6063-0x00000000001A0000-0x00000000001A2000-memory.dmp

    Filesize

    8KB

    Download