Overview

overview

10

Static

static

3

97ee4e31ab...18.exe

windows7-x64

10

97ee4e31ab...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2024 23:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97ee4e31ab54dd1286221f66882afc62_JaffaCakes118.exe

  • Size

    388KB

  • MD5

    97ee4e31ab54dd1286221f66882afc62

  • SHA1

    ed782ac0c113e6ee1573539927f3374b8c3e859f

  • SHA256

    4944771164216ccf6811e327befaa3aea12e9247ff731497a94f3c03d5b1b486

  • SHA512

    1e62643409d12493e3e53da846b746496ae55ccd207ae3aebc321744a62717ea8bbe74280ec5d7373a3478ba16bd5763711a002fc8778aaf1a6f068ffd80d1b0

  • SSDEEP

    6144:9YMk7V7PQkaYO0iNq/PimTBQNEETJYOo0DldfrvwmjcMVW5OouUI5KtrQ8POyU:9nSdO0iNEPn+TGOoYzwscMSOXUIJ

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ppwtr.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6BD2813AF3F701B 2. http://kkd47eh4hdjshb5t.angortra.at/6BD2813AF3F701B 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/6BD2813AF3F701B If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/6BD2813AF3F701B 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6BD2813AF3F701B http://kkd47eh4hdjshb5t.angortra.at/6BD2813AF3F701B http://ytrest84y5i456hghadefdsd.pontogrot.com/6BD2813AF3F701B *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6BD2813AF3F701B
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6BD2813AF3F701B

http://kkd47eh4hdjshb5t.angortra.at/6BD2813AF3F701B

http://ytrest84y5i456hghadefdsd.pontogrot.com/6BD2813AF3F701B

http://xlowfznrg4wf7dli.ONION/6BD2813AF3F701B

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (413) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\97ee4e31ab54dd1286221f66882afc62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\97ee4e31ab54dd1286221f66882afc62_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\97ee4e31ab54dd1286221f66882afc62_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\97ee4e31ab54dd1286221f66882afc62_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\ayndhebhovnr.exe
        C:\Windows\ayndhebhovnr.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Windows\ayndhebhovnr.exe
          C:\Windows\ayndhebhovnr.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2260
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:544
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:840
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3056
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2160
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1864
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AYNDHE~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\97EE4E~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2892
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ppwtr.html
    Filesize

    9KB

    MD5

    26c95f119ea78db509663da1ac1b47fe

    SHA1

    f8eec92299d65944448302e154588c5ed20dc64c

    SHA256

    422933cb8cda506c78306485a2eccecc9f1fc92174f4b15ed72f56fcf3513cec

    SHA512

    80a1d841136e930e7d4e9a7a6b19712016674b77dcf4b44e754d4ef176707575d7ccbb9cdeec4024ab622d607c1d4f7490032ae8c0f59a8dc21883af6760fb3f

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ppwtr.png
    Filesize

    63KB

    MD5

    e88847d62344ac33253dd3ce3fdbeca2

    SHA1

    8e5a3331194ffc8a1774d02fe7948fa9e166684a

    SHA256

    d4baf6c313e2765b3d15c1b922b56cc1e09f07c9c39393b29b152932daf2a7f8

    SHA512

    9be97e34e3f020b67f62423136f181aeebefa1a92cf871691d78e03909647caaa52dff0e2d38a4782294694caa14e1ff776bd40b65393159348610345d7b5ad3

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ppwtr.txt
    Filesize

    1KB

    MD5

    065719809129b6b1403c7e377517f00e

    SHA1

    41051667828032feed1e88273551ae9474d63ebe

    SHA256

    65879848130db39d1afb7b932e0c9605cf705fb694f8f21fdbb956516a0bf5cb

    SHA512

    852086dbf835d7e6816bbf3935004aea6c07754c2bd88050e14369615ced84a9bbfa2c75f93e5ac66b07ebe3a53db02ed83cf2cce0116174ce6727c76b1e0e2b

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    e0167828a0b459353dccdf885b7d58c7

    SHA1

    2a96f7140821868d7aced4b8c610ab8dfb42ecd4

    SHA256

    bfb2780007e1c88533c19b5aee024e377997974fea4679b87217ae38e969d7f8

    SHA512

    fbf59f2cb1eb432e15b12ac378b96867226f9c556f58fef0e9cc53855ed556178405b16f0a515169cd994ce5dfd05c7a95a4405957ca65c26bd4915451622d2a

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    d77d26cd7ce15668a9fc6a96641ca61e

    SHA1

    ac2865411c08804d7ad2e2846ba90ef5e18358ac

    SHA256

    93cfcaa8946ba4872cfa3b5090c99b59b3532bac0ae714e3b5aa0355a0de0781

    SHA512

    c7e694aefa1ecafa8398a29450cb8509f1a88503cc52544386c27d75524a69527c464d315d15b5586d511754867e4898bdfc419504747a7aad593aa40dba7ffc

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    d0bf4d81a3ca6d7dff48602a8d87c42e

    SHA1

    5077b4c7cdd38d670b0fa0221ff9b41d1547c2e2

    SHA256

    9b4074244e56ca7b53bb2d9b1f2b4dd68df663e28abcbff4657bb7fd3e19c55e

    SHA512

    a243bf60887402cb756a30e641c7a8fc4e830c5a6ed26fca578c0a808afd2ed0463193e13ec14772ed87a96fd1dcec426abf9980da669eef388bf698c0353ea8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    338aefe5b27270666188645f59ad857d

    SHA1

    b352545c5f84ca3470a4ab569f6aaee751c12960

    SHA256

    5e7a6d8d1716ba8f3142ca5bd4fe30f24e3be2293e263d9f67076f1c3e96ab91

    SHA512

    33b9770c8e2ee7dd2aa6dcad7452021b7ebadce6a64b417736257ffcd68f7c9f463344770901e36989f3841a28f4157e6ab4bc7ea6f56201e987421a6299e6a5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    596002079022e8ba2656fbca07a08f14

    SHA1

    b2589e5e44371fcfb342fee959488ef8208d49a4

    SHA256

    bd9fa3228a7a70b6b68c9cb379bfb19725c85162cfd55fc20ceb2243dacac7a2

    SHA512

    482c1220aa8ef4a477cc716552a8e3a2f6c54c810096120040db6ad02549ffc40ac15bcf75256a4a7fbefc3893e2feea580d9e869d2732b6e26573d9b0c86f7d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    788373d1294cdca1ac0434d59bed79a4

    SHA1

    8198744a5d0dbb96aa16d5983c67c39388a9c728

    SHA256

    ffb093c7d6654012153483955580febdcd12855774165850d2315bba76054470

    SHA512

    e7b36c0d0f48f1fba8e2fbdcc1263c58f54da2ac12b0b6965769498d934a177080731853b19e98b27432f4074fe3c80b039123e0e586e6e05a28aaed324277e7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9a9aeabd483b268101e2e1678f703cf4

    SHA1

    704568cc5fdf55a7e474c9bd48dfcf096b080269

    SHA256

    d86e2574bf4a850563a4b3989c003a629026f0c1a3d4ed4239d6fb9164ff14a0

    SHA512

    9f6046af0dbf71eec3f165965948cdca94d11c8821a84f5fe51ec6ac1d8479ac7bf3c7b1fc2aacb7099c9e57dc1746c567531ea92031ac2724b5eda3f2e55160

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0a8080f31c46a9e3eca7fdcfb330c1f4

    SHA1

    1b147901a111430385d9cff4375cf6a69eab52c6

    SHA256

    eaf3ca9d50f1de721d68f87af9895c2f4d5517c72f8bd1bdf9bd1fa17eefccb9

    SHA512

    8e548ec12c6c9b66b401214ae406bd2dfce16250c82ce3396e8092caf6bfbafd4911bafeff4bd658794eb261cf0269c6f934ca2606a2fed4ca0523f6ed4855ce

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    927811b39168503e3c7a216275f893dd

    SHA1

    f3924e2de1bc6718788d108dfa4f8889f6e0c7b7

    SHA256

    7d46516b6102db34f4ee8dfaa18f6980fe042588f91bb25ba651dd4e6f10cd8c

    SHA512

    c5e0037b9c31c04c649e301ba8f988211f91ddceaf893f3ee1fdeff89d65497f522fb792e21f17fe4728c611a1319c510da13857e91349d7ceb3da4af440cbf8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    78aa3ac8b580c765280425b3b553a477

    SHA1

    b9b5a41aa1e6e57715adc2739acc00f82980ce22

    SHA256

    fe4c00364f2d683e7f66c595a36eab529f6688833722b82dc3079425f983d2ff

    SHA512

    fd1a7de01526667681493a25bc4f7f20062f0ca34c5428df2fd750caf9ada89ca0572237bebd0571f88f7af887bb6eb715b48888c0a083c8b8ed352f20a7b2e0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab3E1A.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar3E6B.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\ayndhebhovnr.exe
    Filesize

    388KB

    MD5

    97ee4e31ab54dd1286221f66882afc62

    SHA1

    ed782ac0c113e6ee1573539927f3374b8c3e859f

    SHA256

    4944771164216ccf6811e327befaa3aea12e9247ff731497a94f3c03d5b1b486

    SHA512

    1e62643409d12493e3e53da846b746496ae55ccd207ae3aebc321744a62717ea8bbe74280ec5d7373a3478ba16bd5763711a002fc8778aaf1a6f068ffd80d1b0

    Download Submit

  • memory/2208-6099-0x0000000000260000-0x0000000000262000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2260-4405-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-53-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6098-0x0000000004010000-0x0000000004012000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2260-1828-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-49-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6548-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6545-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-50-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6102-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-51-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-55-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-1832-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6103-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-4948-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2260-6092-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2380-19-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2380-0-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2380-1-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2708-8-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-16-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-20-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-6-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-4-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2708-2-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-10-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2708-28-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2992-29-0x0000000000400000-0x000000000085C000-memory.dmp

    Filesize

    4.4MB

    Download