sality | 843126e651f16f0bf40d1d4fe73e133258949ff78fab411cdae1189e41610f44

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d850453af7dc5bbca8ec0a830785f40_NeikiAnalytics.dll
Size

120KB
MD5

7d850453af7dc5bbca8ec0a830785f40
SHA1

13b982031c74cee3f8b826e8a2759d675b2d2221
SHA256

843126e651f16f0bf40d1d4fe73e133258949ff78fab411cdae1189e41610f44
SHA512

e86df14dedffe231a3d599f65ffb5719c30a72f036fd923b6a4e47df26cd423fb3cb217a79a7fb84dda34e4e8ef2c97b009504e092b7d3c61c1bac993fa2bd41
SSDEEP

3072:EvWCoGMHaVN0SHC8L68nJaBhSyD5eAdX8:EOCoGMHb2CNmkrDP

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f766af3.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

f766af3.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766af3.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766af3.exe

Executes dropped EXE 3 IoCs

Processes:

f766af3.exef766fd3.exef7684ba.exe

pid process

2152 f766af3.exe
2424 f766fd3.exe
576 f7684ba.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe

pid	process
2152	f766af3.exe
2424	f766fd3.exe
576	f7684ba.exe

pid	process
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2152-17-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-23-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-26-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-18-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-25-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-24-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-22-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-21-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-20-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-19-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-67-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-66-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-68-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-70-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-69-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-72-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-85-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-87-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-86-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-90-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-91-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2152-159-0x0000000000700000-0x00000000017BA000-memory.dmp	upx
behavioral1/memory/2424-165-0x0000000000910000-0x00000000019CA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766af3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766af3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766af3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

f766af3.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766af3.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f766af3.exe

description	ioc	process
File opened (read-only)	\??\H:	f766af3.exe
File opened (read-only)	\??\I:	f766af3.exe
File opened (read-only)	\??\M:	f766af3.exe
File opened (read-only)	\??\L:	f766af3.exe
File opened (read-only)	\??\Q:	f766af3.exe
File opened (read-only)	\??\R:	f766af3.exe
File opened (read-only)	\??\E:	f766af3.exe
File opened (read-only)	\??\P:	f766af3.exe
File opened (read-only)	\??\S:	f766af3.exe
File opened (read-only)	\??\O:	f766af3.exe
File opened (read-only)	\??\G:	f766af3.exe
File opened (read-only)	\??\J:	f766af3.exe
File opened (read-only)	\??\K:	f766af3.exe
File opened (read-only)	\??\N:	f766af3.exe

Drops file in Windows directory 2 IoCs

Processes:

f766af3.exe

description ioc process

File created C:\Windows\f766bcd f766af3.exe
File opened for modification C:\Windows\SYSTEM.INI f766af3.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f766af3.exe

pid process

2152 f766af3.exe
2152 f766af3.exe

description	ioc	process
File created	C:\Windows\f766bcd	f766af3.exe
File opened for modification	C:\Windows\SYSTEM.INI	f766af3.exe

pid	process
2152	f766af3.exe
2152	f766af3.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f766af3.exe

description	pid	process
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe
Token: SeDebugPrivilege	2152	f766af3.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef766af3.exe

description	pid	process	target process
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2152	2024	rundll32.exe	f766af3.exe
PID 2024 wrote to memory of 2152	2024	rundll32.exe	f766af3.exe
PID 2024 wrote to memory of 2152	2024	rundll32.exe	f766af3.exe
PID 2024 wrote to memory of 2152	2024	rundll32.exe	f766af3.exe
PID 2152 wrote to memory of 1132	2152	f766af3.exe	taskhost.exe
PID 2152 wrote to memory of 1196	2152	f766af3.exe	Dwm.exe
PID 2152 wrote to memory of 1244	2152	f766af3.exe	Explorer.EXE
PID 2152 wrote to memory of 1992	2152	f766af3.exe	DllHost.exe
PID 2152 wrote to memory of 1524	2152	f766af3.exe	rundll32.exe
PID 2152 wrote to memory of 2024	2152	f766af3.exe	rundll32.exe
PID 2152 wrote to memory of 2024	2152	f766af3.exe	rundll32.exe
PID 2024 wrote to memory of 2424	2024	rundll32.exe	f766fd3.exe
PID 2024 wrote to memory of 2424	2024	rundll32.exe	f766fd3.exe
PID 2024 wrote to memory of 2424	2024	rundll32.exe	f766fd3.exe
PID 2024 wrote to memory of 2424	2024	rundll32.exe	f766fd3.exe
PID 2024 wrote to memory of 576	2024	rundll32.exe	f7684ba.exe
PID 2024 wrote to memory of 576	2024	rundll32.exe	f7684ba.exe
PID 2024 wrote to memory of 576	2024	rundll32.exe	f7684ba.exe
PID 2024 wrote to memory of 576	2024	rundll32.exe	f7684ba.exe
PID 2152 wrote to memory of 1132	2152	f766af3.exe	taskhost.exe
PID 2152 wrote to memory of 1196	2152	f766af3.exe	Dwm.exe
PID 2152 wrote to memory of 1244	2152	f766af3.exe	Explorer.EXE
PID 2152 wrote to memory of 2424	2152	f766af3.exe	f766fd3.exe
PID 2152 wrote to memory of 2424	2152	f766af3.exe	f766fd3.exe
PID 2152 wrote to memory of 576	2152	f766af3.exe	f7684ba.exe
PID 2152 wrote to memory of 576	2152	f766af3.exe	f7684ba.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

f766af3.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766af3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766af3.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1132

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d850453af7dc5bbca8ec0a830785f40_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d850453af7dc5bbca8ec0a830785f40_NeikiAnalytics.dll,#1
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\f766af3.exe
      C:\Users\Admin\AppData\Local\Temp\f766af3.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Enumerates connected drives
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\f766fd3.exe
      C:\Users\Admin\AppData\Local\Temp\f766fd3.exe
      4⤵
      Executes dropped EXE
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\f7684ba.exe
      C:\Users\Admin\AppData\Local\Temp\f7684ba.exe
      4⤵
      Executes dropped EXE
      PID:576

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f766af3.exe

Filesize
97KB

MD5
b097491bdf2aef1ed592e7ea88d38680

SHA1
b9aeb1b40191730b33746695f7a12c24ef56d84c

SHA256
4ee655308d2338dd0f3eb320055c4a5de71fa2f6b2b677c6c8a56d9ab2b44c89

SHA512
39b7f20be396aee05ba45c51821cf25674525dd7c2d254fda923f6fbf3be37d7d39a82ad7dd16a7630ef89509daa6125966f7f82a9c627ff38b5d7da0b7ef51e

Download Submit
memory/576-113-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/576-84-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/576-114-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/576-169-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1132-32-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2024-80-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2024-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2024-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2024-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2024-62-0x0000000000960000-0x0000000000972000-memory.dmp

Filesize
72KB

Download
memory/2024-4-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2024-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2024-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2024-42-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2024-43-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2024-44-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2024-45-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2024-53-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2024-61-0x0000000000960000-0x0000000000972000-memory.dmp

Filesize
72KB

Download
memory/2152-24-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-26-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2152-64-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2152-52-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2152-19-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-20-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-21-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-22-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-25-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-67-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-66-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-68-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-70-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-69-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-72-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-18-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-65-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2152-85-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-87-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-86-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-90-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-91-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-158-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2152-159-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-23-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2152-17-0x0000000000700000-0x00000000017BA000-memory.dmp

Filesize
16.7MB

Download
memory/2424-112-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2424-102-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2424-103-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2424-164-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2424-165-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/2424-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download