Overview

overview

10

Static

static

1

13ff5145f9...4e.exe

windows7-x64

10

13ff5145f9...4e.exe

windows10-1703-x64

10

13ff5145f9...4e.exe

windows10-2004-x64

10

13ff5145f9...4e.exe

windows11-21h2-x64

10

Resubmissions

30-12-2023 09:02

231230-kzgqrsedaj 10

Analysis

  • max time kernel
    1790s
  • max time network
    1522s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-04-2024 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13ff5145f905b197eee478e565e30f4e.exe

  • Size

    1.2MB

  • MD5

    13ff5145f905b197eee478e565e30f4e

  • SHA1

    5d983937eeb3ce1455eed52bb478c84d54d64f81

  • SHA256

    df2894b4298be05620b329d27bf0b45314629316fd6a082b6d90bbdfe9bf5a53

  • SHA512

    02a97bcca38b98d481e05bb8216d22bc893594d887b45bb9c87732c0f030dcdcdc40e3f1d3a5954751e888a3056bd44996ea7e36eca37f4977642ef38da417ca

  • SSDEEP

    24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dy2:XHtV7GwBSTc8An/4YF2

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\13ff5145f905b197eee478e565e30f4e.exe
    "C:\Users\Admin\AppData\Local\Temp\13ff5145f905b197eee478e565e30f4e.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:1560
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:4852
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:2716
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2868
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2024
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3048
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1936
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3388
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4692
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3180
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

6
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

5
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\System32\xfs
    Filesize

    178KB

    MD5

    995ad4de1e5f23f198908f3b41477541

    SHA1

    324b7fa7c8eaf8941de4e100c15965b63fa1b023

    SHA256

    ba50acdd71260095120ec320621b04169487cc8e1e24edc009b35c8436789db5

    SHA512

    9c90d112352b373d77fa4596b7a1aa591f1259cdd36327c442869b0d141ee93484d29dbfa7fa90774af9352221ccea3d119f31144ef9c6a09b4d78699b90ad1c

    Download Submit
  • C:\ProgramData\Windows\csrss.exe
    Filesize

    1.2MB

    MD5

    13ff5145f905b197eee478e565e30f4e

    SHA1

    5d983937eeb3ce1455eed52bb478c84d54d64f81

    SHA256

    df2894b4298be05620b329d27bf0b45314629316fd6a082b6d90bbdfe9bf5a53

    SHA512

    02a97bcca38b98d481e05bb8216d22bc893594d887b45bb9c87732c0f030dcdcdc40e3f1d3a5954751e888a3056bd44996ea7e36eca37f4977642ef38da417ca

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
    Filesize

    1024KB

    MD5

    c6210f56088228126919828877963d1b

    SHA1

    9b3e788cf156b874e69bae60540bb1cf379cd2f1

    SHA256

    6fa7a6ffb90c5bc024e5ae9f0dffe929437bfab9c2dc14d7c40eecf0fc2e8bce

    SHA512

    c0be15ff6bb150036e167d6ecfa6405fd57e614e1799f0498c20564e7b1a70b0e9251d241735e42495102f72e98f3df8bb47d32acd88bd198c6e2089ce61d0ee

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    1241bf816f32750e4d54359140402a68

    SHA1

    f4031f2b4986ee4150a4dadd4ea0192bed6b8915

    SHA256

    8e67597ed6eb1ec4fce3fe98f7c99f4cc87f31e327f4587f5589dcabe08938b9

    SHA512

    b4bc61f9a7f7ec79b3ce3561fb30eca2daf53e2fd839cd123ac07fabaa9d16bd99b3e5c5b7737961bae2d77a82260f0e1fa626c61ee4d153521d141237120289

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    75e380ea763b2bf000f910b7a8297cd2

    SHA1

    8ad2a498217a4a331f02f025858a393439b6e477

    SHA256

    f6b92a685c95d45750ac3742bcb67c895169fc84bc9418ccd815329f92ed7b0e

    SHA512

    22f5a143223fc5521f3724f1ecc4cfbf7031ab8d4ddf5ef89c1b7b387706f9f692f86d9ad9f9b1076066d6a7809681419dfbd1d1f6faa5e0f81cc8e51b00bd4f

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    624f1772c59b029aaadde33de03bb52a

    SHA1

    d763d1da461597ff18ade2fc1b9b40f9e4c0d210

    SHA256

    591391fec4aa162c417c1c7feb47b13eb21763aca01026f37f6f253bd2958fb5

    SHA512

    f25dd3220fd6bcb19f76248f09ab2b93177fd996d5995068d2a55885ac864964c75dfbd09f5694438efc0bf8402a005d0e44267f2930f6152b8337ebc2f6fcd8

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    2fe9d4ce1c60adc7758be9bfa9056218

    SHA1

    d11bd7fc7fa273a1b5a528d0199947fe9e72bffa

    SHA256

    ca3564afa59611fd7b2e3c6f1d5447beb3591675b7c6daf2b803db54adadecad

    SHA512

    dc2e6744c259c39b250bc28d196fc56d16ff63bd5e60e8f6e5d16309c104dfe8f147f7293413f7621d4e7a090a1c269bec35895da67a375007f24e386a1aed81

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
    Filesize

    24B

    MD5

    419a089e66b9e18ada06c459b000cb4d

    SHA1

    ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

    SHA256

    c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

    SHA512

    bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
    Filesize

    1024KB

    MD5

    03f6b3c2ce741670b01980bd9201d464

    SHA1

    455b5acb20da77f6b3b568f21ad66a7cbeade8f7

    SHA256

    4de67e45648bdb5d51954b88c8be147f56c1f35126a80e6f777047026b71dbcd

    SHA512

    a7c45aef9ace5e7d38df1f77958d7df2f8da19c7da910e550035f9abb1c2a213b7953deb974924f0d347674729f32b5d3a24b39e0fa726f1e7b86e3a9f9c0703

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
    Filesize

    1024KB

    MD5

    14426870d462939bb4c293567756912b

    SHA1

    9d4500b6b0f00e183b36551601cc21be77809aab

    SHA256

    d7cdf44e01b5e64fab1fd74ac40545aebd29152a9fc6fa7895c28de5c45f7a45

    SHA512

    c03fef6553b47bfad38e945bcfc974dfa07e32dc4c039404c5e752e1763d3b16a603319f279f7a2da6b96a4aa80ff00b84b89b299bac414ed145df8979cfaae4

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
    Filesize

    24B

    MD5

    ae6fbded57f9f7d048b95468ddee47ca

    SHA1

    c4473ea845be2fb5d28a61efd72f19d74d5fc82e

    SHA256

    d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

    SHA512

    f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    5a7e020ba68fa1d472a9720366c289ac

    SHA1

    efbc5340b726dbe321f676118fc6f2edd12159e8

    SHA256

    a45a63cc7d8ee3e6b28ca7fa71539f0968aafefb97b3b1a2c1554595d48eca1e

    SHA512

    2a0d35f7263faea87bb34ff4c30218b49bc6dd0e8d41e72323325406afb60543d31e6be4c2b874a9251e486c6c98e14d6826053ada8bcacfe46b26d0487592f1

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    91b51ef8c65a29304a0f63dd52d4ed88

    SHA1

    5e345b56aef63ef445ade9274c7da9cfa3484854

    SHA256

    1a2b3e2d0aabb84d486eda9692fa1896637a2ead0e30640894b2e838b3a4d7a5

    SHA512

    4164debb108cf4f19f3126fe5174fa73cda0e1b39582d5835b88d4432ed9ee8adb08fd64e87263f3da5a1c198c6f607babe8413229b20c9066edbb459ab48f4d

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
    Filesize

    7KB

    MD5

    31472fdc4484d25e584e9c58ea10c02d

    SHA1

    218f44b15aa0bc095695130fea08d91064dbd464

    SHA256

    cbdcedbe605c9b53e95f595530cf8b86cecbc3f46d67fc96d9ffdd13517768cc

    SHA512

    5f19efec93abdab45b44423af5d0e07b3f49f1fa3ad8894d58d6e9bdb60164cb84a663e0ba7f913670b0b3cdcd446cef7d2f7be1443ecd986d3fef62b0c7c181

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
    Filesize

    11KB

    MD5

    83e1537499c996aa5970a8a72e7ef500

    SHA1

    287d0f3ddd557e5218d5cfada9c47d140c66d2d8

    SHA256

    5fc933f94563ff2f469bc9c861a9236bdcaa0f141c7eb2840977b3b93d3d7444

    SHA512

    6d7793acfb453992b2f6b99d3979bc01f483937edea3fa23dc7d60f07e463e34caada1da1d524091a8df8eee33e27da584a610bcfe5eddc83628423b62495541

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133575769055087213.txt
    Filesize

    3KB

    MD5

    b901e0759bf246eb6f97f10ae24cc06f

    SHA1

    81d1a0ad062c9aec1d65cc41bcd4d0e454a21284

    SHA256

    52a063daf69b4056e4b76a86dced05e443b849835bec32f022ae707a7ff34872

    SHA512

    a3fe21eb87965ed944c2a48a31453a2f2a67f9f8963c20494c3196a9cda1cca970b3125bbb880992e7bbc1786a8d7727778c6006790e0742a239b1bce0ea590c

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
    Filesize

    3KB

    MD5

    d5cbcc60d208f5b81785214af628aaa4

    SHA1

    3ef9cbeaed1d7ded65c60c343844c8ba4e008a8e

    SHA256

    327107d514c4946f8ab7404027fdd73e4032cc5e620f3a03b11aa5c0fda45136

    SHA512

    734242d998c734b4bef2940ecaf5fe278b2063bfd58e8db784a4a94ca711bcf9ad02ddf1688331f3f9863be6551e1fb9a9791eaca8d8b5e96bb44b8717c1f1f1

    Download Submit
  • C:\Users\Admin\AppData\Roaming\204F55D0204F55D0.bmp
    Filesize

    2.6MB

    MD5

    993cc909a89f0fb7fe90acc3703c2105

    SHA1

    f422cdcb426718b235a19080b0daf71c9b448768

    SHA256

    4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

    SHA512

    5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

    Download Submit
  • memory/1984-43-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-52-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-19-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-22-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-23-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-24-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-25-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-26-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-27-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-28-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-29-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-30-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-31-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-32-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-33-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-34-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-35-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-36-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-37-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-38-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-39-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-40-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-41-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-42-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-17-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-44-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-45-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-46-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-47-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-48-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-49-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-50-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-51-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-18-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-53-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-54-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-55-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-56-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-57-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-58-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-59-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-60-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-61-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-62-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-63-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-64-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-65-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-66-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-67-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-16-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-15-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-14-0x0000000002350000-0x0000000002425000-memory.dmp
    Filesize

    852KB

    Download
  • memory/1984-13-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-12-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-11-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-8-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-6-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-4-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-3-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-2-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-1-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-0-0x0000000002350000-0x0000000002425000-memory.dmp
    Filesize

    852KB

    Download
  • memory/1984-68-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-69-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-70-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-71-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-72-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download