Overview

overview

10

Static

static

3

65f583e82e...18.exe

windows7-x64

10

65f583e82e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21-10-2024 07:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    65f583e82e837183c8962dfdbf5bdc35

  • SHA1

    5181731fa74f097de73d81ff347fe2fec634887a

  • SHA256

    1a4a1e76c6d2dc585ce77c9be7163163c0d614d5668a0c83601bb3d6f91376a0

  • SHA512

    827817ae552ebc95dd541d62cc04af0cb798bc33af3960153f403a945f1cb139129fa6e40cd09f359bbc673ac6c11118eeecf1a33790873a9c070bc487e24a43

  • SSDEEP

    6144:SzVGON09XRWtlggcMOEqmgWqvANwxcLSgL8J4bAvtqjPtW6wU25vB8ynNd98UW:pON09XotWgOfmgLA8cNYQAojtwU2xnv9

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dpmtf.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A07CFF8BC494239 2. http://tes543berda73i48fsdfsd.keratadze.at/A07CFF8BC494239 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A07CFF8BC494239 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/A07CFF8BC494239 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A07CFF8BC494239 http://tes543berda73i48fsdfsd.keratadze.at/A07CFF8BC494239 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A07CFF8BC494239 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/A07CFF8BC494239
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A07CFF8BC494239

http://tes543berda73i48fsdfsd.keratadze.at/A07CFF8BC494239

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A07CFF8BC494239

http://xlowfznrg4wf7dli.ONION/A07CFF8BC494239

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (410) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\sbowqhnifqfu.exe
        C:\Windows\sbowqhnifqfu.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\sbowqhnifqfu.exe
          C:\Windows\sbowqhnifqfu.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1580
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2324
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2176
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2816
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2848
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SBOWQH~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\65F583~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2908
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2692
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dpmtf.html
    Filesize

    11KB

    MD5

    8b3fea40ec03551ecf5c445e756c0499

    SHA1

    5cdd2b9288be0fcf168a54b8ddd3d7b98351b77b

    SHA256

    aa3d22eee0da29bd6a2d95cf072944d45e9cf607360e38839748f2baf47fd0f9

    SHA512

    d338c7b7f2c06b2d8db29c3691c78c5980591270c696a139b131a19f9394bae4d047507f59c6f2a25743009ea94d53a638b57e1c4bfdda69d8fd420cf819fe5a

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dpmtf.png
    Filesize

    64KB

    MD5

    b471ef04d6009e96bc673bc47d9d79bf

    SHA1

    dda23d327ec0a77f376f29ed6650eee1d5508b29

    SHA256

    5e796937ad1a7ef084a09c50d42f7cd6c6db6c4d204709fcdd1c52fe79cc38f8

    SHA512

    82188f88c2d9ea6054dd1a144f008cae6a201379a800f26c2c3762f3d71a05006128fe56fd4ebbd3bc0576a85129cc589a3c4b9a66be857f5fd1509f30a8d80f

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dpmtf.txt
    Filesize

    1KB

    MD5

    37cce6149939c8f25cf58258295b0ec3

    SHA1

    1b9bd5a8be3ad05f185c14c787e2b6f988b18e00

    SHA256

    2ac7e0932cdf305aa846dfb269c0ccff60efc288f3caa53b8e7f7628dc60cbd2

    SHA512

    c40359cb6333dcec4b36641fe52f3ab048839299785ab9077eaad50cfcc22a1e2df7b469e16153ca2f1873e0ad8200ca45232f9577bdbfdeb477cd6b38e19028

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    7484bea31b1651b0f64892dfcab285b7

    SHA1

    f27229bb15c4ec63a1c0da2ed72117c2c93ef60b

    SHA256

    62e58f39e50348f77497bc8bb39353c7b8f0db15cbe09c0890131e422001ef16

    SHA512

    fbf7d9c3522e3985ad85419e10bfa70bd82054389b27f725a3e74e6f01eb8431ee3a505465f4d817404c2a787455f0608984edf6e7c5e94fffe40aa793f35359

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    e784539245e4301bc016b957e471340b

    SHA1

    792547b09b59c010d786d72d966156b4d304e16a

    SHA256

    da70b2d745cf31b25283eee2abdb22d7db968fa1f6cbfa34e6ada3d684e08678

    SHA512

    a43cd3a67f20d90a7c9d018c0dda4aab010fb2a56cfcab2ff3e1002c9dfb2ff3f75c29a0e56ff04794f130d7984b5959203a44ed8e8bd17c0a4ee1fca3ed7349

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    bd4a0ee91cd14dc3c1c72a3024a472ed

    SHA1

    e56c228f4c6d213a5c6ad76dcd7e57125f1ac786

    SHA256

    cfa3b30885119558dd9d0f9cb8b83b80f1c55c079143db6e2a45bb8db535f329

    SHA512

    d313ab2c4cdc8ca02d939feb887e322cf3ad8f3d175b5ed113545c68888016ee935ba367348a113420dbc4d346cadf88eb16688a85d235c43bb2c868d608ce6b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b5d3189ed3d8cd0504875fa80343fb9c

    SHA1

    a51a6ce0f10bc9e145e2549c19c6baaf53452af7

    SHA256

    e4215187ab3d4c5678caf5efc788ab2f2a6446da37e21c8e9536611b5caefc99

    SHA512

    5ec22818f195a3f37edbeb4abf9003e20c5a200f447f388b371b9289f39a616ba8dd2ef27280bb568d117995f1200c729395bec329732c15cb19dde0b94e552b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    6b9999a43e09efdb8b5e351b46ab2f66

    SHA1

    efd23fd1d18222a2cc670e8bcaf28c3fc1c78383

    SHA256

    4172e3a394af7ac2328a2d940bf7be0b76bae930f8e9f28e27bc08c7a778d383

    SHA512

    8cf0b2421c3bb8bdee9ec06876d23df0ad292810774653aecfaa4845d790462c3faed6c9fee704a9e9bb72102b9c4d943251ce0fe2f71fee3170c5b103936b95

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d6b65fd52e5fe389cf7f0fd01d1eb63d

    SHA1

    1990d26c2c894f843a73b0f270fe68c71056744e

    SHA256

    72ece26bbaa63ddc32a2ef4b104becaa6237fe6e3f21372a892cfc816d4ea216

    SHA512

    0953dff6cbeeb15720bb67c317965de6121d89cff0a81acc077077e0252e98b28ef86cda62412691efceb524400587e542eb8bd9e5e1d3171152118ffdbb1ae6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    88f7cd62f0756d7803f06f63781ea3a0

    SHA1

    482c1630b62ba5a0feac1d937303937bc2feb28f

    SHA256

    7f4e39d00e7219614ddd9a8ce63660550e45ce3fba039cbcdd20d9d3f2a164ac

    SHA512

    b5b2fe31a9784697b550eba1830c08a48aa19cdcb58ba4ae9552b5e583357dd8140c66015a5e495ae06f02814677fdf7eab04c426fd891e6dd77be25ae7eec4f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    81494885888767fe7c0d77ca9720da85

    SHA1

    5c3a1ff4e5c092d69d3e54340ab24a9fb7b22df4

    SHA256

    0f85922b06f4854261a336c6794fe44cd60346c52d806afb7fa4b71759bd542b

    SHA512

    11706a43718e177a882dba2800d6ed1bb41a9cbe1c9a84cf8d6032a613c8251f1f1d79727c747e80a7e7af477084974fe52c36265e202030068d21a03f6aad2e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1e8aef442e4d105c1dc73a050db96c2a

    SHA1

    6135ac26ea91f104acd816541f022bbe2c79ef3f

    SHA256

    2280e43d0d4d6dacd45042feafe95f844272022540ad2f427a8041a36eb976a2

    SHA512

    2e53c78f5b5d59bcd02dbc44202c11b2693d050d05342c4341aca32ccd4c3ceed362727deeca6b68acca7cdaabe7d6ccde5a8bf0267783bc3e4982068ec35ef7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    82d18cc7269aae99e7a4da9a2d0692d0

    SHA1

    bddcd2e866943b8d6ac64742e790d5e2d91d4bf8

    SHA256

    ccc4597e40e7aee8a7bdb4fef31ca5d1e147b4c19ec1f958e8335b3f448745fa

    SHA512

    455e1f9b18778c8ce6973d53af73d3cc6872d496aa6d74b9a0c09a265804e4234ac195e0a663ebe9ceb9fec9a8a1f7f0a28ad4cb882bf42b4513670ceb273e2c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    349d5270c1a1ed439db7e7dcbbd874fd

    SHA1

    dff36ec2c3707d13ec79f5bfc0c9109ef411173d

    SHA256

    e93bc5cbc918af383eaf3ce51de1cf4e34b955d7d2d818be87776364ddf3728e

    SHA512

    8ae3f41aab4e8554dce3bb0d8695259281104ad3c3f4b538644e5dae588295a4b14c98decf9320f1f5a55e374e3bec49a78406c2c18d907cff13c1ee10eec52f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2f79cc950ce609df69fae5a054e17b83

    SHA1

    4aa46ede78df95fc73147b56a28a312d81b5728e

    SHA256

    3ac3338657cce5839285d16aabaeb819eb6832f7130a172d342a2af5e704e774

    SHA512

    b24b6a78af06daaec815475ca1936d4d022ae2d453fe898c21a172331858eab5ff509f0805c666211c2b3136b046b8b136d19921564b40c468b51d1b69031114

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    04814a9ee4638b65f09e0b8ca0c23b7c

    SHA1

    8432dc6bd5277cd115fbc8f8b3b48c889d7218bb

    SHA256

    dea36b7238dabb3f9ed33ae7577da81ba4d3752d06089973cfb23aa726ea7043

    SHA512

    d9aff82e5a58c00e7d7936a25eae681519c01cec8c6ae4b56fdc9b214a6d3daa4bb6e0f797935bfb4a26cbb18641977e71f531b2930238a5818e21f4a7b0ef96

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8ac0ef28e39f635fc42364324cc97722

    SHA1

    006bfbcfc48327621bff7e66f40f6b65081b6e69

    SHA256

    0f4d11d0d84b256ad8264bdfecc697a26e6b834afbc104b6df4a88a1508c70ac

    SHA512

    c66f6267adf0ede3055904a06c1b98c815de393b6c754701551e6c3cba730ef30aa92cedc891937632dcddd1f09acdce355a9ea558b1fcb8cbb0370c5b401792

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabCFEF.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarCFEE.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\sbowqhnifqfu.exe
    Filesize

    384KB

    MD5

    65f583e82e837183c8962dfdbf5bdc35

    SHA1

    5181731fa74f097de73d81ff347fe2fec634887a

    SHA256

    1a4a1e76c6d2dc585ce77c9be7163163c0d614d5668a0c83601bb3d6f91376a0

    SHA512

    827817ae552ebc95dd541d62cc04af0cb798bc33af3960153f403a945f1cb139129fa6e40cd09f359bbc673ac6c11118eeecf1a33790873a9c070bc487e24a43

    Download Submit

  • memory/376-0-0x00000000002C0000-0x00000000002C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/376-17-0x00000000002C0000-0x00000000002C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/376-1-0x00000000002C0000-0x00000000002C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1580-6097-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-51-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-56-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-54-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-52-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-1779-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-1783-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-5159-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-6072-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-6078-0x0000000004040000-0x0000000004042000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1580-50-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-6082-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-6094-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-1098-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1580-6096-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6079-0x0000000000160000-0x0000000000162000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2700-10-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-4-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-6-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-8-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-31-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-20-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-19-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-16-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2700-2-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2712-28-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download