trigona | fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b | Triage

Resubmissions

21-01-2024 14:53

240121-r9d6ysead3 10

18-04-2023 10:19

230418-mclsbacf2v 10

Analysis

max time kernel
150s
max time network
167s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
21-01-2024 14:53

Sharing

Report Analysis Logs

General

Target

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Size

1.1MB
MD5

530967fb3b7d9427552e4ac181a37b9a
SHA1

41bcf469661ab9609a0d181953c2f8ffb75bb483
SHA256

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b
SHA512

b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa
SSDEEP

24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL

Score

10^/10

trigona persistence ransomware spyware stealer

Malware Config

Signatures

Detects Trigona ransomware 14 IoCs

Processes:

resource	yara_rule
behavioral4/memory/956-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-7-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-2633-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-4335-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-4950-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-6181-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-9941-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-11964-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-13924-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-17291-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-20511-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral4/memory/956-22762-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona

Drops startup file 1 IoCs

Processes:

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

description	ioc	process
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3632047111-1948211978-3010235048-1000\Software\Microsoft\Windows\CurrentVersion\Run\0BF35394D28162FFD8D3DACB200F8A05 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3632047111-1948211978-3010235048-1000\desktop.ini	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3632047111-1948211978-3010235048-1000\desktop.ini	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\desktop.ini	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

Drops file in Program Files directory 64 IoCs

Processes:

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\SnippingTool\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\adcvbs.inc	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Java\jre-1.8\lib\ext\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWAD.TTF	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SnipSketchStoreLogo.scale-125.png	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\security\javaws.policy	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Media Player\en-US\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CameraStoreLogo.scale-125.png	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.UI.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\AppxMetadata\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\ReachFramework.resources.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jsound.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\ReachFramework.resources.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\Fonts\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsWideTile.scale-200_contrast-black.png	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
"C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3632047111-1948211978-3010235048-1000\desktop.ini
Filesize
2KB

MD5
9754ebe2ab707ca0f3016dbf8b34bdfa

SHA1
2d78053db90755aadb0b5a9ff9a0eedc11a680ac

SHA256
0fd3b653653122b8cb3b029406dbc5584e7a28310339473930717a76478f6d3c

SHA512
9bc7709de9157d665a9685a6e7e1034dca0f1b10f6a3fa632a3a9b430c84b226c4bc2771af8b3848698604b97b957b9e7d65f3e48c712d864d54eb58e85e4fa3

Download Submit
C:\$Recycle.Bin\S-1-5-21-3632047111-1948211978-3010235048-1000\how_to_decrypt.hta
Filesize
11KB

MD5
51dcaf669676000a5f1bb4b26ec64a79

SHA1
87044b41dcaf44f7441d0e15acf38100f1d1c213

SHA256
6c630514f518e2b79c1fd51c36d896e54f414e0e2b8577fe4e468d68c7f4c0b5

SHA512
0194ea85b2b7aa31107802895901e3bbb2c68d74650ddaa65729969ff5566ade23a1636bcaa744d2bd2fa7983b825118d81e891f31bf419e3b0de80b06fb373e

Download Submit
memory/956-4950-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-6181-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-2633-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-4335-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-9941-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-11964-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-13924-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-17291-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-20511-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/956-22762-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download