Overview

overview

10

Static

static

7

94b88650eb...02.exe

windows10-2004-x64

10

94b88650eb...02.exe

windows7-x64

10

94b88650eb...02.exe

windows10-1703-x64

10

94b88650eb...02.exe

windows10-2004-x64

10

94b88650eb...02.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:30

240417-rt43faca49 10

17-04-2024 14:30

240417-rt4fxade5v 10

17-04-2024 14:29

240417-rtyknaca44 10

17-04-2024 14:29

240417-rtsz6sde3z 10

17-04-2024 14:29

240417-rtspeade3y 10

31-07-2022 05:21

220731-f17w5aade2 10

Analysis

  • max time kernel
    1198s
  • max time network
    1177s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-04-2024 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

  • Size

    1.5MB

  • MD5

    6599f79e40a26186261b58aa89194e5b

  • SHA1

    0a44b71f930447d545de0f10b6f9c70d513acacc

  • SHA256

    94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02

  • SHA512

    9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748

  • SSDEEP

    24576:4i9CFkYBMSUkGUbDkAv0f3BIykhWmRkLhKRahLo1ChjllyzD8k20ZItIhi4Gx:4ieMSU0bD7Q3Bfkh9k1VtKChpIzD/Std

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
    "C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
      C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe List Shadows
        3⤵
        • Interacts with shadow copies
        PID:748
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:3612
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe List Shadows
        3⤵
        • Interacts with shadow copies
        PID:4852
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3112
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3236
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4844
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4784
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3360
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3584
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2444
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3020
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

6
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

5
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
    Filesize

    1024KB

    MD5

    904d4819f44c674b22f654c6fded86d2

    SHA1

    12ba00ebb35364790bd5081186d86f73f136d4bd

    SHA256

    505bf118f44fc36780af6415be4b7bfe8c3aa0eb0c2865ab640eaf540fa667f0

    SHA512

    1e242885e70aab51ea132aaec18127f547c0f377f4a72b02dbf100af3ed45b04161d1bb328927af09b89826201daf18fe47dbf18586bb72719e9bd0a85612b11

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    32de370bdfc009cf22aee891e117ccde

    SHA1

    7ca8fd83f27485e461640fb31fd1fcae8498fa1e

    SHA256

    6250edbd1cd63d87502a17625d9d6d28517711c0a82e36c866d82c62b8f19e61

    SHA512

    c01ddf12332436b779a56ce9c7f88649241e46f3d680f6d447df13fb9a00389c9c6a11dea488cf75ac3930584a0f09b81f31e1df47f093c5076145c98b687c99

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    720518f96d1271799ab57a831233c4cf

    SHA1

    742df6b48e300c092a72dcb1a66b57bcd1898e22

    SHA256

    2d7eb59c68e3640279a19d44cc11d0a8fe2bf8315e7dd91649985603bdcd6e64

    SHA512

    5628702b9cef1dac70288f74fac8571321fc8ee9b0b72b1349f6767cc6ee24db15497ec3234a72c4dbe35b9847d414e2798dc1525079d76a327b2c969458753a

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    83ef8c0f2146b55c4b71143c97f80db5

    SHA1

    c542ee3860a1f351d41fdc8b564093b03d1d333f

    SHA256

    08cf4cf53f874671b193bde236c9a51cf1ad25a42581372dd5023155991d608b

    SHA512

    5c6d23491c640ab73c0c4883ea5759d9f14543c561f075255b024e119c2062b34a292a7e9a68587e552c61a5af2a50fdd43cac13b47fa04f2785e0eb96a85a28

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    d998d0b4efd72445d6a803334335d1be

    SHA1

    1afc773af6797957694bfcb6afd9ad3e061ac7e9

    SHA256

    26ce65ff25b0f046fee95c6dec682a70e269700ca976ee644b34a81b39234020

    SHA512

    5ffee1c8346bc6059ea917680b77bb55f56abcec32321be7304121a9c575fe336aea65eec61ee874fd047dbaad9f5d7c169b864735c8d03a5c53524619d8f675

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
    Filesize

    24B

    MD5

    419a089e66b9e18ada06c459b000cb4d

    SHA1

    ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

    SHA256

    c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

    SHA512

    bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
    Filesize

    1024KB

    MD5

    c55db5f4d1b9139fc0b0a658943fb534

    SHA1

    0f73c92826a15c6d207e91bb8bf91bc545903e85

    SHA256

    31f9d6ad5fb63d94c4f14cc4defd96b1cf6e95bb386878e7f9ed789679c6dc2e

    SHA512

    0265d2818c40651868bb15badeb5d4166c27ddb31b4ef24c0d976569fcea9bdc14109a4e3edef18d2c0e17d2fd81e1fd65c022ca453ed9a9ad1978c6212b5981

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
    Filesize

    1024KB

    MD5

    a1777c83fda382dd002e9ee593657bd9

    SHA1

    15b001a082cbae6f85178e5b384215bf22d388ce

    SHA256

    a77f88fe6b7ee1577c55a042651ced30cacd400fa4e6265350ee24e58c0522e6

    SHA512

    1e0403383662d1c13c87b5120d9cc0ee94af3f4641276e7593cba90ffb7b18a08a0211f249596ed710df440b99f5f81b8fa5385772704c458c7f00b7d7db20e9

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
    Filesize

    24B

    MD5

    ae6fbded57f9f7d048b95468ddee47ca

    SHA1

    c4473ea845be2fb5d28a61efd72f19d74d5fc82e

    SHA256

    d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

    SHA512

    f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    94ba4a2911c47faf1ff3d119cc33235e

    SHA1

    2e23fe3205ae0f413632ed4d70714e569d74135e

    SHA256

    e7caf249abb90245e5e6d9e5716c6359c65808326fc3a0578156f973f94ca56d

    SHA512

    797efe5f8fc6e10ec19a1819a7a9d41d21e0e0aa95094acd10051c47bef3f56285348efd4921bbb40990a2e8a4ca5be5844f55f12bc37ee3914a6e1b17a99a9e

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    a9263797c61d7d4cf944f4fc75c0befc

    SHA1

    252def011f057195057f67fb64b06378e4a74889

    SHA256

    b74a40bdfabd5c47c0b505f5d9f164e8d5eb12cef6adc4196f6cc16132f3e559

    SHA512

    1b4dacbd6822f3beb463164cab68cd1dc3cd0c3030c2d348b35f539f605252ced684f471a392440e57fd6e188feb2c9ebc663a9c48943f14fd6a26bc380a9097

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
    Filesize

    6KB

    MD5

    292034617cd36b277ecbebf75f6f51bc

    SHA1

    5c8b9b101a55cdff3d2ba1b96013b1aa278af71b

    SHA256

    2175f2f5ff32d4ca7496faf6f4eea49e73b7b935e68c08a0d7e82a9e2239cda6

    SHA512

    e6198a547ea322684ede292552541586c5ff29d84bf626dbbdde445f380558c0459697905e7e7e4f42119d35110c25ab8bd82137b2a30a2cdd70934971b84988

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
    Filesize

    10KB

    MD5

    17cdbfb366f2038bd60edbaefea7f2a6

    SHA1

    5edf3e32f3b137c35fa7be3cbe93d7b1501f0c63

    SHA256

    f9a35ba678da0c5210929381bb0ee1a02c1d794f66fc8336090291f8de3f3f78

    SHA512

    037203d3e78ea40e8f19f16b48acd1e523638976b45f7ac45c1a3206da96b1f51944d88e6bbc27abfda237545576103fd0f8dbb54e772ba8f21bbaf32dd44126

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133578535265347120.txt
    Filesize

    2KB

    MD5

    65d939ef67bf440d30c8dee4eebe4890

    SHA1

    5aa8c724f2e458d7c7c6fe7bd6daf0f48b13fc40

    SHA256

    e7abcd543a39be760c610fb1cd8a101abfffc6002e47aaf7dea39b31f94a3531

    SHA512

    8237d8dcab2898614b13f052ca540e6f094b7eb4653a110b572967b3fd34c5d29982cb1ada9a4e38702d08cf736c684ae8269aeac55f0fcbcc2d5b04dfbb50e7

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
    Filesize

    2KB

    MD5

    ce18ce56e99b0becdac1acf971555307

    SHA1

    a5b25803f7806d2a3f239803684bd70f65e5420c

    SHA256

    798187064fe76693b6d43336013ce439514fd2626290ead457e99c89dbb3607b

    SHA512

    e93a9ad9904bfd69c5d2a84be883326b648baed7e5b828bdbe7a1b897410eaafd2f9332c3de18d4f1ea2ab50a05aa424169f347ae495cc8b3510a26fe5c010a9

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\OC9I7LFD\www.bing[1].xml
    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

    Download Submit
  • C:\Users\Admin\AppData\Roaming\C2445B77C2445B77.bmp
    Filesize

    2.6MB

    MD5

    993cc909a89f0fb7fe90acc3703c2105

    SHA1

    f422cdcb426718b235a19080b0daf71c9b448768

    SHA256

    4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

    SHA512

    5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

    Download Submit
  • memory/3140-53-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-63-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-30-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-31-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-32-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-33-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-34-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-35-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-36-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-37-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-38-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-39-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-40-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-41-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-42-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-43-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-44-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-45-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-46-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-47-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-48-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-49-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-50-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-51-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-52-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-7-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-54-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-55-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-56-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-57-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-58-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-59-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-60-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-61-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-62-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-29-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-64-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-65-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-66-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-67-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-68-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-69-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-70-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-71-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-72-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-73-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-74-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-75-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-76-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-77-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-78-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-28-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-27-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-26-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-25-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-24-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-21-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-20-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-19-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-18-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-17-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-8-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-10-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-15-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3140-16-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3772-0-0x0000000000400000-0x000000000062A000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3772-3-0x0000000000400000-0x000000000062A000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3772-6-0x0000000003310000-0x0000000003344000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3772-9-0x0000000000400000-0x000000000062A000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3772-11-0x0000000003310000-0x0000000003344000-memory.dmp
    Filesize

    208KB

    Download