Overview

overview

10

Static

static

3

6bcc066e2a...18.exe

windows7-x64

10

6bcc066e2a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    126s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 20:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe

  • Size

    340KB

  • MD5

    6bcc066e2a81f34c7e052895001f44c6

  • SHA1

    6f892ec0287ace1c4c7c86e3945b44de6c9d3ba8

  • SHA256

    39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc

  • SHA512

    b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c

  • SSDEEP

    6144:2//b5dx5w2hahQGvPmZ8n0SylbvO+MeTHLlj9HhRbr3ET4b7ODRJT0luqig:SddvwdhHvPmZiyIXgLl3ZoMq4wO

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+eeopr.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D84D3DF744C6DCAD 2. http://tes543berda73i48fsdfsd.keratadze.at/D84D3DF744C6DCAD 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D84D3DF744C6DCAD If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/D84D3DF744C6DCAD 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D84D3DF744C6DCAD http://tes543berda73i48fsdfsd.keratadze.at/D84D3DF744C6DCAD http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D84D3DF744C6DCAD *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/D84D3DF744C6DCAD
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D84D3DF744C6DCAD

http://tes543berda73i48fsdfsd.keratadze.at/D84D3DF744C6DCAD

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D84D3DF744C6DCAD

http://xlowfznrg4wf7dli.ONION/D84D3DF744C6DCAD

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (420) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\atcqvbojllgj.exe
        C:\Windows\atcqvbojllgj.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\atcqvbojllgj.exe
          C:\Windows\atcqvbojllgj.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1696
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2916
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:1388
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1196
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:604
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:324
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ATCQVB~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1684
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\6BCC06~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2744
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3040
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+eeopr.html
    Filesize

    11KB

    MD5

    b2dcdbf6cce888dbfd0ed9f8d5764eee

    SHA1

    d8d848a123b20504ec4463f90199b3c74fe4318f

    SHA256

    e14428b56441398f1b5fd6f1c5a15eedfe2b0caa2f90d0dbddef10b0e081508f

    SHA512

    802ef1b46bbb6367c2518a102732d9dc7c7fc7e601abf74201eec2b69ba68f079d89d46858528e5cd9077f2ff204fdef95931de415bf5b4a91e52453eeb77976

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+eeopr.png
    Filesize

    62KB

    MD5

    cf371c69494c9e59ccf639cd6b50431e

    SHA1

    7dae66f0f3a7c9de218568be25c2f0379a749b0a

    SHA256

    008f02843b378f204fd25d291e7dfdcab61b5a19e1bc1566226ad014c36917d5

    SHA512

    92845869a3bbb36fe7f1b04e1783c91e9faf39681cd642013fd108517700dace46fd0e3c0c1549069634042e71e9ce4c0e919d9feb182b7ca5321558ed903039

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+eeopr.txt
    Filesize

    1KB

    MD5

    e51bf008bcf071b978813f2d2c21c8f5

    SHA1

    d9033eb2956f7a0d949857c1414fdce174bbd9b1

    SHA256

    3c57a9e94fb6674f8c7b77677a150cd6e0a7c8fc79b558764cc8beecd941f7e5

    SHA512

    80f07af0783d020afbf252ae1254739c0c3ebafc2b058192dbfe688c0c801a78aff88a8d60b06f44ab1700421e657e14e6dd9dbb07824149e308f27286ae8d28

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    44e098d1ef618160249eb31739ae3015

    SHA1

    916a0daebaa087b914d1af5a7968b209c82979e0

    SHA256

    2e1299823f0f00074a09d784ad1dbfc204c9e003003e61468eb993c67a2e1100

    SHA512

    ea20561db2ae2cd4570e3b1325f51c3015f022771364b1ce0771b0f312d30a697565c88b9db0e5421ebf78bbb2f8f024be2f95e66096c46eff94faebcf91b1b5

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    4e9705c41e7994bced38c9d146200599

    SHA1

    14111e1446a9a95932ff5640794fa09d70fa6f4d

    SHA256

    75c12d295fb055acb6b707aedc143ef154cd4a4d04af7ecf8f897daebee8fdf5

    SHA512

    18661e532de80b3e440c804d6d18c55827cdeefae6be489ff42fdf67ad45e7e901771b809f22efcead8f0a74fe6a85220403ac7cf96896b6d06bb29531bed5fd

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    59b061bc78ad6a9618d747a8980fee24

    SHA1

    8ca79707fb28a8689b366a775ccf39de22958c1a

    SHA256

    bb1b89ce083f7593ffd6871e10dd0bf9aaa55445069ecc5b310f371e0b2cf5dc

    SHA512

    b5ecf8be8be9d5ad6386ed56ae9321c7c4a702ca7801cc928bf32e4388028249ec49737910ce7c618b6f85b5d45cd06601b94736bb82b5ef717b6bbc05797b8e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    7cde9fde662a938c15b1c8bc411bb00d

    SHA1

    aad9d03ec5bf13588c5d08ebff1859037065c4ee

    SHA256

    99d6804bfef2944004b10a552e94fc0f6f4d9d5d6f77c7ed4c7f765d1df24ae0

    SHA512

    418b1e7c49c1af0287bf75fe21aa29c8dedc123e2869cc0da15e07b74bfc346a1fa2cbbd4d65293995d816bd881e6b149015988ef420405dcb1a05986c7a8cc7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bea4296126231003d08b8c6ec3c558ec

    SHA1

    2b58568c260abd5ee7d1bcdd74a98e3e658930c6

    SHA256

    2d34626e5dfec9d38cbc5746ffe15982996ee017de888d8357292af667570aef

    SHA512

    1157b37de729d95886a15f3a94a242d1a0193c4cb87ca78b5108a26d2c85e0a51a7ad1e5708536e50ed96bb95d9b12d952f995ec3388b7fae3822dbc69db5bcf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    69bfd7ee9002654e732095cf776b1723

    SHA1

    decf20b6d8a61571036f26c659aa215d6fc25f33

    SHA256

    569aea38193b03a0544e3bc6ed1554298bc6c223c6d43fbda2eab3dcd2546185

    SHA512

    d5ced1ff9b1ba2030dd43e92d0f30cb459384bfd322c97482fafdafbb6a8b2d528b5b2c5023fc87d465376e3f2d99a4fe14196d78d977e84ba24a76ac2201bf2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f99117235dffab3dbcc96e938c3125c2

    SHA1

    86c0c90be7216743356223c0c27012176b16545e

    SHA256

    217970f36aa530f8e6f1d07cb5610cddb05d0497ff964520bb3ecde7f619dc5b

    SHA512

    00d1979c9587570543a00885d3d26017476cbccf8dcc1ea3acdfff83669ab461bdfb043435b7d870e433b5e64bf226964dabe57d035312279a846df337f01d4f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    040d21bc06b86a79c4b51fc77f34d4f8

    SHA1

    afda664201f7c93d5faa8d36b254005342cb0bf9

    SHA256

    7b913613f9d7fcb9320b63052a1b1c24e584805c24bc1e5a5407067faafe7f2d

    SHA512

    762fea8753d31d2486407b579076ee88e633de6eedcedf69dd25b37cf01fa046ad4bd9d213c65d3db9fe0214faff8b1a02125ffe242fc6fd7c2f8b719fcf444a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9e2c2073da617f26beaad651cef051df

    SHA1

    8bd10f6c9f5693f99693a80df1a07651c61a9a04

    SHA256

    885cc87fdde50afe2d973390d76abf2a8cf8e3a85e5419cfb6ffa0cfdfb41869

    SHA512

    dfbc8b3410e881bb6bc06988b56749de3aa9c53ce52c02c37f55bc3d0d9918985d0a374985064a637338930b1b4119fe98e9c63aefd005babd96a29ff1c60cb0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4ef9f3a66f74a8e4d3d14694b80ff835

    SHA1

    4afda63488d5fc903605d6396e80de92ddd2d512

    SHA256

    92c6fbdee9454daf2a4418291c07441e74c84dc7e20ddd327b0a8862ec56205f

    SHA512

    829e2d0bd373184725f3a9b84094b6bfeb1305abbb177d50838f7afbb630324fc985961bfa83154f3efdcc22ded17971b11f18dc70b1f60ce7b9f9bf054b29d1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    540a064be837e475584a8f9d325f548c

    SHA1

    c5eae3100646e6def4f18e69c4b2c4a8e63acf6f

    SHA256

    8fef9ba04c25ff004a62f9dddc43484b93055ae619cde7d5d27107a05e6bbeba

    SHA512

    f204c08512a132e8cf59ae112f9e9744136ded323f067ced899752fbf60584239e8cccf179ca6620965ffb02b007eef70371c615accea93c7474e148a26ca6c2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f1c6c201cca9b239033b3a3494d5be3b

    SHA1

    4321aaa75af613372f067559e4f8f2eb0511f3c2

    SHA256

    cc85b141e8fab7eee33c842473ec141ce5b2dad3abd189ba66e0e487a69f3f5d

    SHA512

    2915e0296d0cf96877ab920b49c865de79e6426f2dba6c8a0e0f03f0ca0fb4ff931b6c78a16ce8d66132a99948399bab3d92ad10b4e96214129e8a338066f43e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabB78.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarBD9.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\atcqvbojllgj.exe
    Filesize

    340KB

    MD5

    6bcc066e2a81f34c7e052895001f44c6

    SHA1

    6f892ec0287ace1c4c7c86e3945b44de6c9d3ba8

    SHA256

    39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc

    SHA512

    b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c

    Download Submit

  • memory/1696-6116-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6108-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-47-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-777-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-45-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-1261-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-1260-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-46-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6113-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-3814-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6098-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6099-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6109-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/1696-6105-0x0000000002BB0000-0x0000000002BB2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1696-52-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2548-6106-0x00000000001A0000-0x00000000001A2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2684-16-0x00000000003B0000-0x00000000003B3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2684-0-0x00000000003B0000-0x00000000003B3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2832-5-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-15-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-3-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-27-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-7-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-9-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2832-13-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-17-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2832-1-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2852-28-0x0000000000400000-0x0000000000578000-memory.dmp

    Filesize

    1.5MB

    Download