Overview

overview

10

Static

static

3

a5eb9cf3b1...18.exe

windows7-x64

10

a5eb9cf3b1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5eb9cf3b138e8466071ec20a6722b5c_JaffaCakes118.exe

  • Size

    336KB

  • MD5

    a5eb9cf3b138e8466071ec20a6722b5c

  • SHA1

    5b8db28fdc2e40fd67b3de164eb9d904122e5cef

  • SHA256

    ea7be43ae12bab3a5c3e00a568f3b3564c9225a056960048eda72f9f8f9f690e

  • SHA512

    499af2dfd9997cd737ebdd758d7c84e36084d5db5cf1f2eb032fd496b549e808303eb73275e9ddf378e966972c1ddbab03174ba5b9b97fd4c75c2ba1e5d14a24

  • SSDEEP

    6144:81w0U6D6x4kyjf+g0uc2RTqWmx7Ikw9NShXvSmk2OpXaP/EBySkQ4:8i0Uu6ikyjcuk5y0hXaxpKkB

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mxjho.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6FCD24062A01422 2. http://tes543berda73i48fsdfsd.keratadze.at/6FCD24062A01422 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6FCD24062A01422 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/6FCD24062A01422 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6FCD24062A01422 http://tes543berda73i48fsdfsd.keratadze.at/6FCD24062A01422 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6FCD24062A01422 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6FCD24062A01422
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6FCD24062A01422

http://tes543berda73i48fsdfsd.keratadze.at/6FCD24062A01422

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6FCD24062A01422

http://xlowfznrg4wf7dli.ONION/6FCD24062A01422

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (416) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5eb9cf3b138e8466071ec20a6722b5c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a5eb9cf3b138e8466071ec20a6722b5c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\a5eb9cf3b138e8466071ec20a6722b5c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a5eb9cf3b138e8466071ec20a6722b5c_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\afypgrntrrsh.exe
        C:\Windows\afypgrntrrsh.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\afypgrntrrsh.exe
          C:\Windows\afypgrntrrsh.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2360
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2276
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:1864
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1916
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:328
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3004
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AFYPGR~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A5EB9C~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2576
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:236
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mxjho.html
    Filesize

    11KB

    MD5

    6019c1af521e5fbd4bfce2fb247d8795

    SHA1

    16f1a331740077e77d7d13257b53c061f711113c

    SHA256

    e9e8f74891cab73fe0d2aa03444c35720732a83a1fbc35b8ff499cbd8a24a505

    SHA512

    91fce75e6ac973028dad83b6e7faa909c6bbdcb5cf4ef0bd6420f8fb287d061bed08aeeb38a704b99c11a281585c56e4df018e4c6cd94f6c7a177bf037ba08cd

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mxjho.png
    Filesize

    62KB

    MD5

    3c25d8cd5e8de32bef756f11f72b57cd

    SHA1

    9cc116fb050534d1a2dff206583d26001bc59f48

    SHA256

    afcda42d3bd94856d4909f39dda9a4963af9ddda188f64215db525b602132f53

    SHA512

    f845a1d775fd9cd906f2f0d5f80e528e78b03e810ac9d6176f7c98c827c1f78ed2de8b270f0311d766fd390f74a213d410977d1ce59864db5db4ac7e6df8f140

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mxjho.txt
    Filesize

    1KB

    MD5

    71dbfece37fa1588ab68f9ac373754de

    SHA1

    8ab2d68afbb191a51019aad75ce4c59a15fb9a4f

    SHA256

    3d4c81f6dfee34c0dc523ef2efabcddb3635d17b171cb0dc04fb4d2adaac8db4

    SHA512

    68fca142aae4c0e39c8129b4d91b8644419cf162f724be7f546e7f43be8f1438e3256d5f2b38f4a2729c6568c0e522dcaf92b3a4b9e5b8155db8767c7d012a00

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    42f31fa488520de3e85aefd2151bcd0d

    SHA1

    7fed662fefe8fdd7a73d4cb023c066cc07224864

    SHA256

    7c122795f83e321245c695e721623eb03e54643bd214a1b5063fc90b0b28a2f2

    SHA512

    743b679efbb0bcaa79b877088d6576926eb89bf7360e83ac8c2837b7c4ddbf2aec1533f3328f46c2694551a69e51a4beb943e83e557f9cf60ed9bafbcdd03f36

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    21e5c1673ca1d0f97f7ca480f786bdcc

    SHA1

    cd44c497f88caf725b623229d9604402cd170b1b

    SHA256

    3a2385949a34a5083ebc61ce028468a2851ef9761b63aac2c4a0122adbdd62bd

    SHA512

    9eba75ce853e60e56af0cb3aa4ce339e0956382316c62745bfdb8e8886254aaf7407f10d9937d11043797f19d7dbb76e52e28ad4b5c2001a562ed2e2c86bffff

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    49164f43fdea8f663989552c30c1c6df

    SHA1

    95602227ebbe8e9e8e6f5c85173fd75c0d66a487

    SHA256

    bc44e80051e4e71416c5dd4908ca5cb44aeb15f3fcbb2648d12213d2deba7853

    SHA512

    83d1e65cd3d2ae343c8ba53de8875194d78a1f509e5a88f1d10f01a2474d1635d5c632a6739c58c690fc01befc7c6a3eaf1be15eca6fe1d466e1df838c506a2d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    17dd0d7c81ee66dd1ba0d8906d03815c

    SHA1

    ef1c26fa0dd6e5b79e52baf7eb2e5381a9682675

    SHA256

    eb48d3d4663435a244d6d6007d634c98151a94ca5a0975a113651d007e0878e3

    SHA512

    28395a9c3846efa3ec77163b7f07b23f98461c84bf08014ea1d5e273eb8d2c4913f703962765862083372c2aef118c8c10c6cb45ea571f4f1a19f433e7927c72

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e67604f206d00a970ba271d72274a0af

    SHA1

    3218a6cdb480929f60ceb0819af56ca26302c4e8

    SHA256

    bdbe35abb652337fba338e0edb75399f3d286662fb8e905c287c53b911d8a4b1

    SHA512

    e7f01c1761a065ba70898aa9baa682bd57b8720dc15d5d552e28001933432bda1c81f4458e8dc6a33ed860ee361507c490e7876e7f074e7544fc0cdd99383b44

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    884f3db5aa7ccbf47256717a419c143f

    SHA1

    effeddbd7dccb18f8c3de5f4dae4902b58cbed9a

    SHA256

    c2d3a0960e6524aa258ec2ed11827fc700ef1e6b555ee3754ef3629e919fa300

    SHA512

    0e5985b1b5ef1328ce655317ed0b9c2c412ebdeac5f934218fc9a9d7c79f2ccec1633de8112bf36f17ed84ed13ecd721d981c4c372fba065f7fa15fe91370280

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    642144df745f9afe6020f9a4ed33ff3e

    SHA1

    0cd88b1e82929bc9aba516c6a3586a1470389262

    SHA256

    deeddb102b470387a6c0e8912a792ab5cce3b4d6afacda1376ef4ccdcb3a2ff0

    SHA512

    e28eb83929a0ee6da87f3b6f607cb9d8de0ae92c6852e59bf97f1012d0e8e4f802008e8c4ecd89f5750fd297c5e3c04a8fca391a4772df46fe3100d1fc531187

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2a55f35e65f1a00796de8854a357acc1

    SHA1

    5090663f15ac2cdfd441e792a63a6e6a78f0b37f

    SHA256

    9a1ba4c40d831aef10a061893844f8f93543cdda25ff882ef35dc1df48103275

    SHA512

    834e3f23e1a55bdcee0135532a59f06fe6b479bb0afdcfb34f4c628a2c2a13a881feac4c99b089572e9c1173734c4393d4350a83fb8b1b60e06ad2517d67a14b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bfd10b819165422f8ccbffae8ce13992

    SHA1

    97076f864fe457225e8135cdd4f10b669b5c8215

    SHA256

    30796b9234d8c27f34420c258b5483e94a2d36ac8f3bab9fe5f9969207be96dd

    SHA512

    1ad03f6a36617b6feac08bbb9242e06389ad018df03233c69fc7abc339f5407394675be3ea36e737f3ca8f552378e5cbd92acda285a4c338009236804bd12879

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b604d8668fa94532a9ba816500dcaaa6

    SHA1

    751936d15a6b610e82410d999567d2ac69d6f451

    SHA256

    8fc0dfc663128b537ad40fe63d2df14db9d0ab60d667d9f74b2bcba7aa3e19f3

    SHA512

    66076de885daa48847e7c67b71f50e72349266f02854043f87720ba7a36b5f4f784fd1aaa0420999415ce09b2c20c2587619f414fa6478189d7f98811f5b0f41

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1e2ab2a2e0fd93d5434e30895f95dc75

    SHA1

    ff6949229defbc73b84022844120950dce861b93

    SHA256

    824a7802abac9930bf5c28f49ed0532ed69d3195702735f2052d87a54093fc8f

    SHA512

    a336223e711c45b82d10dca8e424d3556c160f2aa5eddf334451ee9e67d8d694c3f562783bfdd12cb37bad07a295b42e756139d4f43d9ed20cc00dbf3500ca41

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f9ce5666129d49b679700b08ccb855dd

    SHA1

    012def08a487de088ae9dc71fb46773906c85e22

    SHA256

    cab69f08a1fe81d3b7a5e9cbd9d63f26fa5d16f1bb463dbb8f14d0e9f4fe9268

    SHA512

    776b539522c10bd36012ba8457df2dc112bbf4ec748bd442ee29ab886a640507c10f88d265815c189f8e17e7047d58058a8556780cc5f85cda4d8bbea75f6dae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5EF5.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5F65.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\afypgrntrrsh.exe
    Filesize

    336KB

    MD5

    a5eb9cf3b138e8466071ec20a6722b5c

    SHA1

    5b8db28fdc2e40fd67b3de164eb9d904122e5cef

    SHA256

    ea7be43ae12bab3a5c3e00a568f3b3564c9225a056960048eda72f9f8f9f690e

    SHA512

    499af2dfd9997cd737ebdd758d7c84e36084d5db5cf1f2eb032fd496b549e808303eb73275e9ddf378e966972c1ddbab03174ba5b9b97fd4c75c2ba1e5d14a24

    Download Submit

  • memory/2252-6091-0x00000000001B0000-0x00000000001B2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2360-6094-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-1767-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-46-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-45-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-49-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-1766-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-6099-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-1992-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-4742-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-6084-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-6090-0x0000000002C60000-0x0000000002C62000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2360-6093-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-47-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2360-6102-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-5-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2552-1-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-13-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-16-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-17-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-9-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-3-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-7-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2552-28-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2636-0-0x00000000002E0000-0x00000000002E3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2636-15-0x00000000002E0000-0x00000000002E3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2720-25-0x0000000000400000-0x0000000000748000-memory.dmp

    Filesize

    3.3MB

    Download