sality | 108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e

Analysis

max time kernel
33s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af70fcf0d4032564a34f82a4cda2ae87.exe
Size 160KB
Sample240229-znf3escc2s
SHA256 108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e
MD5 af70fcf0d4032564a34f82a4cda2ae87
SHA1 ee316a23ecbb38933e0900da3f6db73470f664f5
SHA512 7715435ec4872a1fb2beec46eedf10cf37ffef6a0cb9a5c07956e6636b5f19e34b3597befe8f5cf98c2ae1e0ca5488fca88f3fe2349fa8a9e5214ed26d3c5366
SSDEEP 3072:JP24nrk3mmJ+4o4W4IeooDto6djDcOIjNE+y78Z+C6Pr+HFkYI:JbUo4W4Iey2oNi78ZR6PyHFLI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	af70fcf0d4032564a34f82a4cda2ae87.exe

Deletes itself 1 IoCs

pid	Process
4852	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
4852	Au_.exe

Loads dropped DLL 11 IoCs

pid	Process
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe
4852	Au_.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/472-2-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/472-4-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/4852-229-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-228-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-230-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-254-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-295-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-300-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/4852-311-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	af70fcf0d4032564a34f82a4cda2ae87.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SRCheckPermission.txt	Au_.exe
File created	C:\Program Files (x86)\SRCheckPermission.txt	Au_.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	af70fcf0d4032564a34f82a4cda2ae87.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023231-12.dat	nsis_installer_1
behavioral2/files/0x0007000000023233-16.dat	nsis_installer_1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	Au_.exe
4852	Au_.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe
Token: SeDebugPrivilege	4852	Au_.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 4852	472	af70fcf0d4032564a34f82a4cda2ae87.exe	88
PID 472 wrote to memory of 4852	472	af70fcf0d4032564a34f82a4cda2ae87.exe	88
PID 472 wrote to memory of 4852	472	af70fcf0d4032564a34f82a4cda2ae87.exe	88
PID 4852 wrote to memory of 788	4852	Au_.exe	8
PID 4852 wrote to memory of 796	4852	Au_.exe	9
PID 4852 wrote to memory of 388	4852	Au_.exe	13
PID 4852 wrote to memory of 2436	4852	Au_.exe	41
PID 4852 wrote to memory of 2464	4852	Au_.exe	42
PID 4852 wrote to memory of 2556	4852	Au_.exe	45
PID 4852 wrote to memory of 3360	4852	Au_.exe	56
PID 4852 wrote to memory of 3644	4852	Au_.exe	57
PID 4852 wrote to memory of 3872	4852	Au_.exe	58
PID 4852 wrote to memory of 3968	4852	Au_.exe	59
PID 4852 wrote to memory of 4084	4852	Au_.exe	60
PID 4852 wrote to memory of 2668	4852	Au_.exe	61
PID 4852 wrote to memory of 4116	4852	Au_.exe	62
PID 4852 wrote to memory of 2156	4852	Au_.exe	64
PID 4852 wrote to memory of 4896	4852	Au_.exe	74
PID 4852 wrote to memory of 1948	4852	Au_.exe	75
PID 4852 wrote to memory of 3720	4852	Au_.exe	81
PID 4852 wrote to memory of 5028	4852	Au_.exe	82
PID 4852 wrote to memory of 4872	4852	Au_.exe	83
PID 4852 wrote to memory of 4948	4852	Au_.exe	87

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	af70fcf0d4032564a34f82a4cda2ae87.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2464

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2556

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\af70fcf0d4032564a34f82a4cda2ae87.exe
  "C:\Users\Admin\AppData\Local\Temp\af70fcf0d4032564a34f82a4cda2ae87.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:472
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - UAC bypass
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4852
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.7.37&CID=&IID=&BANNER_ID=&REQUESTOR_ID=&COUNTRY=&SG=&USER_CREATE_DATE=&Affiliate_Id=1000007000&ie_user_agent=
      4⤵
      PID:1368
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3872

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4084

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2668

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1948

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:3720

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:5028

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\86GPDKUQ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\0E5775AD_Rar\Au_.exe
Size 88KB
SHA256 d9e6aacf461011e39561b5e25c11c99def46f1383df9cafdc9bc32f4c1424c7f
MD5 d83e133946333009535a552d468f13f2
SHA1 ef53babb39197c5b45050e740ea7a9097f416702
SHA512 a57766dde469e6af537a8620acaa125f10e30c70a1aff9cafca8001c08287c6ae6411af578226e86b3ec67ddf969ce5733a065a2bf792f9273a548a552a268ff
SSDEEP 1536:MyQBynRvnrk3mmJgoiUHear3d8PrzanmVr8ppr44p1Mr7gI:MP2tnrk3mmJZZ+C6Pr+HFkYI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dialer.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd75EC.tmp\Dialer.dll
Size 3KB
SHA256 4742cddec8e5e059ca106fb85f6a2dc690c18461b4cde07b36aa2b25c6e3f2c9
MD5 7666a3ea04037ba2f04512879cf7ae9e
SHA1 5622855c42657d8a4ffc2ad87bbf06d0218ccfe6
SHA512 16e7d4f5cae64da54eda4f9a89e2214f9ad0c7fb8d2173fb1a807fe52180284ad8e834f447720a2d4c4e0ff996cac6ce6c7a6275b4eb66eebb81905b3f6052da
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd75EC.tmp\InstallOptions.dll
Size 14KB
SHA256 17f0946e0847bbaa6a06eb58aead13fce22a8606e9b3744cd2241debdf8d8bae
MD5 7e49eb67f1f3c62bb8c4b0a868b30645
SHA1 2be42e3c6059485bc3b624a537ab1fb36a10a263
SHA512 469c28b6da5b9499fd417f8cd74414d6c6edcbe6567eecc9421a69797a77ec323936deb96cd151611da57e311074ec0c56d82a9800d7aebac9538a947284ff9e
SSDEEP 192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallerHelperPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd75EC.tmp\InstallerHelperPlugin.dll
Size 49KB
SHA256 ea67e8f37654c7278903c73d62fbc8ec183881ab32feee5e2109c84715e63ecc
MD5 52a442935d96e94c780ca616feed71f3
SHA1 45e3d0af4e7582a0241433de6a73571100334b83
SHA512 289accf4ae88bd34f02577d7f1339a551c5e2230c354663c616a887f1c54630e044e7be2ae68035ff660d75eaa1e313c3aad35f1548a0b16842da7d7375f199e
SSDEEP 768:TWcIgKCbS2OAjFeiIWPwEPBRXkDYGzLk14IAm5oYKLPK:Kc3KqS2OXWXoDUZ587K
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd75EC.tmp\System.dll
Size 10KB
SHA256 7f3057abae7e8b5b91a35fbb23897657accb8c724e923d5d4a0e9208ca09c445
MD5 de86f5220bcbbac420fc4f6166bb2d91
SHA1 d0d52fdacbcffe0058cedfc20cf5108475033f5d
SHA512 d22f7807037c410427518891dee5dd535361df514ce0980a654d99d32f369b5e9c2059bc5930d807e93ebb3b7741d09466dd87bb796256daf9d8a630280fbe99
SSDEEP 192:mO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:DKAFERdlxhGRYUzqZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd75EC.tmp\ioSpecial.ini
Size 1KB
SHA256 8eb452bff31690511b95156f323ee2f61727256a605a1dc424f365944d457af5
MD5 2408d77c8be185bf9fe7b5ef22b82faf
SHA1 99db0ec775ebe9ba9f0ba3ff0ccfb70bca2b1b3a
SHA512 32bc9241ae4c7b66dd8acdf5bba9e62884e2bb57ddbfd59cd564ccf58ebf9a96bcfe40678772bccdffcb16d8439b92cd6422f5baa84cd35ba531c8246f6a76e8
MD5 SHA1 SHA512

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 160KB
SHA256 108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e
MD5 af70fcf0d4032564a34f82a4cda2ae87
SHA1 ee316a23ecbb38933e0900da3f6db73470f664f5
SHA512 7715435ec4872a1fb2beec46eedf10cf37ffef6a0cb9a5c07956e6636b5f19e34b3597befe8f5cf98c2ae1e0ca5488fca88f3fe2349fa8a9e5214ed26d3c5366
SSDEEP 3072:JP24nrk3mmJ+4o4W4IeooDto6djDcOIjNE+y78Z+C6Pr+HFkYI:JbUo4W4Iey2oNi78ZR6PyHFLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYSTEM.INI

Path C:\Windows\SYSTEM.INI
Size 258B
SHA256 ec5080cadbe18fa15935be2c1699cca32320dbee99566b705c48dfa0f86ce71c
MD5 092bbf1798ea786bde1bd38e143944d3
SHA1 e7160c5f2b0e16444533bff45d40bc697a20d08c
SHA512 c73f45f5f1d1c963af16dd81818bc799315c9341db91b24deca9b498c09f9c7e6dfe7b0af4826a89126d6e2dd3240d1b023efdee84a1423d4e129d0fb81880ba
MD5 SHA1 SHA512

Submit Download

memory/472-14-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/472-4-0x0000000002360000-0x0000000003390000-memory.dmp

Download

memory/472-2-0x0000000002360000-0x0000000003390000-memory.dmp

Download

memory/472-0-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/4852-233-0x0000000005CF0000-0x0000000005CF2000-memory.dmp

Download

memory/4852-234-0x0000000005CF0000-0x0000000005CF2000-memory.dmp

Download

memory/4852-232-0x0000000005F40000-0x0000000005F41000-memory.dmp

Download

memory/4852-230-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-231-0x0000000005CF0000-0x0000000005CF2000-memory.dmp

Download

memory/4852-254-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-295-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-228-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-300-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-311-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download

memory/4852-337-0x0000000005CF0000-0x0000000005CF2000-memory.dmp

Download

memory/4852-341-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/4852-229-0x00000000031B0000-0x00000000041E0000-memory.dmp

Download