sality | 4054c5abfa746ad538f94202fdbea55ce823eb6f35f5e728c8d6653391a6eacd

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

496fad4459c52e9f7c7ffe378469f560_NeikiAnalytics.dll
Size

120KB
MD5

496fad4459c52e9f7c7ffe378469f560
SHA1

6ad11aaadb260e369e1d12bd5305a8e75546e927
SHA256

4054c5abfa746ad538f94202fdbea55ce823eb6f35f5e728c8d6653391a6eacd
SHA512

1f1c13bf44673cf4b5b95ebaa9f662aabfaae65edd2f363b0cb1b876309a1f616e3d53f0c7290aaa265d1f68a6f96d195e4ce7fe4ab2ff983475e341165fea71
SSDEEP

1536:ikjcmHs0bRXGf/650ScnMmvEM3sL3E7nmHziA8zvG1omuRyOnJNFFT:ik4iscs/6TcTsssoOizuOpXvl

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f766f95.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

f766f95.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f95.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766f95.exe

Executes dropped EXE 3 IoCs

Processes:

f766f95.exef767214.exef768a84.exe

pid process

2552 f766f95.exe
2444 f767214.exe
2592 f768a84.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

3040 rundll32.exe
3040 rundll32.exe
3040 rundll32.exe
3040 rundll32.exe
3040 rundll32.exe
3040 rundll32.exe

pid	process
2552	f766f95.exe
2444	f767214.exe
2592	f768a84.exe

pid	process
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2552-12-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-16-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-14-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-19-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-25-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-17-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-40-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-15-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-20-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-18-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-61-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-62-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-63-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-65-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-64-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-67-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-68-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-82-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-84-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-86-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-104-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-105-0x0000000000640000-0x00000000016FA000-memory.dmp	upx
behavioral1/memory/2552-149-0x0000000000640000-0x00000000016FA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766f95.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766f95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766f95.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

f766f95.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f95.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f766f95.exe

description	ioc	process
File opened (read-only)	\??\S:	f766f95.exe
File opened (read-only)	\??\G:	f766f95.exe
File opened (read-only)	\??\H:	f766f95.exe
File opened (read-only)	\??\I:	f766f95.exe
File opened (read-only)	\??\K:	f766f95.exe
File opened (read-only)	\??\L:	f766f95.exe
File opened (read-only)	\??\N:	f766f95.exe
File opened (read-only)	\??\Q:	f766f95.exe
File opened (read-only)	\??\R:	f766f95.exe
File opened (read-only)	\??\E:	f766f95.exe
File opened (read-only)	\??\J:	f766f95.exe
File opened (read-only)	\??\P:	f766f95.exe
File opened (read-only)	\??\M:	f766f95.exe
File opened (read-only)	\??\O:	f766f95.exe

Drops file in Windows directory 2 IoCs

Processes:

f766f95.exe

description ioc process

File created C:\Windows\f767031 f766f95.exe
File opened for modification C:\Windows\SYSTEM.INI f766f95.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f766f95.exe

pid process

2552 f766f95.exe
2552 f766f95.exe

description	ioc	process
File created	C:\Windows\f767031	f766f95.exe
File opened for modification	C:\Windows\SYSTEM.INI	f766f95.exe

pid	process
2552	f766f95.exe
2552	f766f95.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f766f95.exe

description	pid	process
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe
Token: SeDebugPrivilege	2552	f766f95.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef766f95.exe

description	pid	process	target process
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 3040	2732	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2552	3040	rundll32.exe	f766f95.exe
PID 3040 wrote to memory of 2552	3040	rundll32.exe	f766f95.exe
PID 3040 wrote to memory of 2552	3040	rundll32.exe	f766f95.exe
PID 3040 wrote to memory of 2552	3040	rundll32.exe	f766f95.exe
PID 2552 wrote to memory of 1268	2552	f766f95.exe	taskhost.exe
PID 2552 wrote to memory of 1360	2552	f766f95.exe	Dwm.exe
PID 2552 wrote to memory of 1392	2552	f766f95.exe	Explorer.EXE
PID 2552 wrote to memory of 2156	2552	f766f95.exe	DllHost.exe
PID 2552 wrote to memory of 2732	2552	f766f95.exe	rundll32.exe
PID 2552 wrote to memory of 3040	2552	f766f95.exe	rundll32.exe
PID 2552 wrote to memory of 3040	2552	f766f95.exe	rundll32.exe
PID 3040 wrote to memory of 2444	3040	rundll32.exe	f767214.exe
PID 3040 wrote to memory of 2444	3040	rundll32.exe	f767214.exe
PID 3040 wrote to memory of 2444	3040	rundll32.exe	f767214.exe
PID 3040 wrote to memory of 2444	3040	rundll32.exe	f767214.exe
PID 3040 wrote to memory of 2592	3040	rundll32.exe	f768a84.exe
PID 3040 wrote to memory of 2592	3040	rundll32.exe	f768a84.exe
PID 3040 wrote to memory of 2592	3040	rundll32.exe	f768a84.exe
PID 3040 wrote to memory of 2592	3040	rundll32.exe	f768a84.exe
PID 2552 wrote to memory of 1268	2552	f766f95.exe	taskhost.exe
PID 2552 wrote to memory of 1360	2552	f766f95.exe	Dwm.exe
PID 2552 wrote to memory of 1392	2552	f766f95.exe	Explorer.EXE
PID 2552 wrote to memory of 2444	2552	f766f95.exe	f767214.exe
PID 2552 wrote to memory of 2444	2552	f766f95.exe	f767214.exe
PID 2552 wrote to memory of 2592	2552	f766f95.exe	f768a84.exe
PID 2552 wrote to memory of 2592	2552	f766f95.exe	f768a84.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

f766f95.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766f95.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f95.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1268

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1360

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\496fad4459c52e9f7c7ffe378469f560_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\496fad4459c52e9f7c7ffe378469f560_NeikiAnalytics.dll,#1
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\f766f95.exe
      C:\Users\Admin\AppData\Local\Temp\f766f95.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Enumerates connected drives
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\f767214.exe
      C:\Users\Admin\AppData\Local\Temp\f767214.exe
      4⤵
      Executes dropped EXE
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\f768a84.exe
      C:\Users\Admin\AppData\Local\Temp\f768a84.exe
      4⤵
      Executes dropped EXE
      PID:2592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f766f95.exe

Filesize
97KB

MD5
0cdbe71777dacc8608b8eb68b00b57b6

SHA1
ff1179ad2d91f215a7ea1b69d219e9fd209dbdea

SHA256
35170de7e1ea31795cc4f273dc4fab71692e184cf77136bf5c070fb82999dfbe

SHA512
5ddb46f60fc0f415887346debc93e721ff5c1953ee85d2233020b38b8f1acd1a5aac25da14c18a5a0a1e26a130f1b41a51b8fe1c143bfb9c1c0fe29b508d0f94

Download Submit
memory/1268-21-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2444-96-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2444-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2444-94-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2444-102-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2444-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-145-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-15-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-82-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-14-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-118-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/2552-16-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-105-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-104-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-48-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/2552-12-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-19-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-25-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-17-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-40-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-39-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2552-42-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/2552-20-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-18-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-61-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-62-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-63-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-65-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-64-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-67-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-149-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-86-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-68-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2552-84-0x0000000000640000-0x00000000016FA000-memory.dmp

Filesize
16.7MB

Download
memory/2592-101-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2592-103-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2592-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2592-154-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2592-100-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3040-79-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/3040-41-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3040-76-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/3040-31-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/3040-57-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/3040-58-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/3040-56-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/3040-32-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3040-9-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/3040-10-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/3040-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download