Overview

overview

10

Static

static

3

d8a5a5ae00...e5.exe

windows7-x64

10

d8a5a5ae00...e5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    20s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 04:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5.exe

  • Size

    343KB

  • MD5

    db610ee561ee75545d06dd08f90f59f0

  • SHA1

    38473820167d560e67aec2ad118fb1eefdf7e1ed

  • SHA256

    d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5

  • SHA512

    3e5f960648e321cf24bfc54727c4c13fbad09f41c20fdd7dfeb915b03f6c3c6415a0982924483285f401c1e511ebdf2a5fbd6adee6ba7e72a9c42b64f47cdb11

  • SSDEEP

    6144:2qHGoq/TMMFIgLYW6E5vmCT/jBqxDi4d/5WyQYEx:24dNMFIkP5vB/j2Di4dxWtx

Score
10/10
ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 15 IoCs
  • UPX dump on OEP (original entry point) 29 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:808
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:812
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2652
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2664
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2868
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3368
                  • C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5.exe
                    "C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Suspicious use of SetThreadContext
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of UnmapMainImage
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1020
                    • C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5mgr.exe
                      C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5mgr.exe
                      3⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of UnmapMainImage
                      • Suspicious use of WriteProcessMemory
                      PID:4384
                      • C:\Program Files (x86)\Microsoft\WaterMark.exe
                        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Program Files directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of UnmapMainImage
                        • Suspicious use of WriteProcessMemory
                        PID:5044
                        • C:\Program Files (x86)\Microsoft\WaterMark.exe
                          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4220
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 180
                            6⤵
                            • Program crash
                            PID:2260
                        • C:\Windows\SysWOW64\svchost.exe
                          C:\Windows\system32\svchost.exe
                          5⤵
                            PID:2252
                      • C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5.exe
                        "C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5.exe"
                        3⤵
                          PID:4972
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 180
                            4⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3056
                        • C:\Program Files (x86)\Microsoft\WaterMark.exe
                          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Program Files directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of UnmapMainImage
                          • Suspicious use of WriteProcessMemory
                          PID:4364
                          • C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
                            "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
                            4⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of UnmapMainImage
                            • Suspicious use of WriteProcessMemory
                            PID:244
                            • C:\Program Files (x86)\Microsoft\WaterMark.exe
                              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                              5⤵
                              • Modifies firewall policy service
                              • UAC bypass
                              • Windows security bypass
                              • Deletes itself
                              • Executes dropped EXE
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Enumerates connected drives
                              • Suspicious use of SetThreadContext
                              • Drops file in Program Files directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of UnmapMainImage
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:756
                              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:440
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 180
                                  7⤵
                                  • Program crash
                                  PID:4712
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\system32\svchost.exe
                                6⤵
                                  PID:2432
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                  6⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4084
                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:17410 /prefetch:2
                                    7⤵
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4628
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                  6⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3176
                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3176 CREDAT:17410 /prefetch:2
                                    7⤵
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3168
                            • C:\Program Files (x86)\Microsoft\WaterMark.exe
                              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:316
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 180
                                5⤵
                                • Program crash
                                PID:3388
                            • C:\Windows\SysWOW64\svchost.exe
                              C:\Windows\system32\svchost.exe
                              4⤵
                                PID:880
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                          1⤵
                            PID:3516
                          • C:\Windows\system32\DllHost.exe
                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                            1⤵
                              PID:3708
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3796
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:3868
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3992
                                  • C:\Windows\System32\RuntimeBroker.exe
                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                    1⤵
                                      PID:3404
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:2492
                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                        1⤵
                                          PID:2552
                                        • C:\Windows\system32\backgroundTaskHost.exe
                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                          1⤵
                                            PID:4424
                                          • C:\Windows\system32\backgroundTaskHost.exe
                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                            1⤵
                                              PID:4912
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4972 -ip 4972
                                              1⤵
                                                PID:4112
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 316 -ip 316
                                                1⤵
                                                  PID:2576
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4220 -ip 4220
                                                  1⤵
                                                    PID:2100
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 440 -ip 440
                                                    1⤵
                                                      PID:4868

                                                    Network

                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Create or Modify System Process

                                                    1
                                                    T1543

                                                    Windows Service

                                                    1
                                                    T1543.003

                                                    Privilege Escalation

                                                    Create or Modify System Process

                                                    1
                                                    T1543

                                                    Windows Service

                                                    1
                                                    T1543.003

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Defense Evasion

                                                    Modify Registry

                                                    6
                                                    T1112

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Impair Defenses

                                                    3
                                                    T1562

                                                    Disable or Modify Tools

                                                    3
                                                    T1562.001

                                                    Credential Access

                                                    Discovery

                                                    System Information Discovery

                                                    4
                                                    T1082

                                                    Query Registry

                                                    3
                                                    T1012

                                                    Peripheral Device Discovery

                                                    1
                                                    T1120

                                                    Lateral Movement

                                                    Collection

                                                    Exfiltration

                                                    Command and Control

                                                    Impact

                                                    Resource Development

                                                    Reconnaissance

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                      Filesize

                                                      343KB

                                                      MD5

                                                      db610ee561ee75545d06dd08f90f59f0

                                                      SHA1

                                                      38473820167d560e67aec2ad118fb1eefdf7e1ed

                                                      SHA256

                                                      d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5

                                                      SHA512

                                                      3e5f960648e321cf24bfc54727c4c13fbad09f41c20fdd7dfeb915b03f6c3c6415a0982924483285f401c1e511ebdf2a5fbd6adee6ba7e72a9c42b64f47cdb11

                                                      Download Submit
                                                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{40D733A4-2A08-11EF-B1BA-6699275097D0}.dat
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      7fcb44570624c1199ddc2c575b50b49e

                                                      SHA1

                                                      8f6a35eb635ffde7ce5edba739722290a88bb148

                                                      SHA256

                                                      80d9a6d03ab02da9446825ff135483e6e10226786aa7fd134e03ec398ba5a97b

                                                      SHA512

                                                      fcde3c1d67c3962adad657eb2cdef7fb94f07d57cd30adcc63f651c8cde96ec3bbfb993aa9c09ac52f3958816a1ab4035e12d67d94df4517880df018c8df35f1

                                                      Download Submit
                                                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{40DBF7C4-2A08-11EF-B1BA-6699275097D0}.dat
                                                      Filesize

                                                      5KB

                                                      MD5

                                                      46c299e34d3c2aed98f05ef267d00e45

                                                      SHA1

                                                      cbb99be15ba0ddaed93b2e4900e3e28c80ad9a17

                                                      SHA256

                                                      2aa824af3625ae9dfe086acd12674c308fc3b10b0b9681ae6924e2eb4ffc8f2d

                                                      SHA512

                                                      95d440f104576beb0dcc4334baa04e6a513d2f2213a5ac7d7dbc8a17a931a5c0a0873ccb39615a36cbd830bbcf2815ce54c5ab43ad93cb375bbb2650a3163960

                                                      Download Submit
                                                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver470.tmp
                                                      Filesize

                                                      15KB

                                                      MD5

                                                      1a545d0052b581fbb2ab4c52133846bc

                                                      SHA1

                                                      62f3266a9b9925cd6d98658b92adec673cbe3dd3

                                                      SHA256

                                                      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                                                      SHA512

                                                      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                                                      Download Submit
                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\suggestions[1].en-US
                                                      Filesize

                                                      17KB

                                                      MD5

                                                      5a34cb996293fde2cb7a4ac89587393a

                                                      SHA1

                                                      3c96c993500690d1a77873cd62bc639b3a10653f

                                                      SHA256

                                                      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                      SHA512

                                                      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                      Download Submit
                                                    • C:\Users\Admin\AppData\Local\Temp\d8a5a5ae00005e3da9f58b5c36e78d5ee974a8f0308b05adf3b63fbb86c0dae5mgr.exe
                                                      Filesize

                                                      168KB

                                                      MD5

                                                      c81960aefb3afc22deb400ff7f46e055

                                                      SHA1

                                                      0df9c9d0bd90f155562d23b725594f928bf25d34

                                                      SHA256

                                                      59cf806b4dfddb829196278a1d2e18f7956d2fd1ac6f54d460a11d2441ad9eba

                                                      SHA512

                                                      dd86ca45cb086beb9775f1377cb94b0444d4b4d173804c5e1868ab8224e206620737c67e838544e6134f52fad6c2eb6acf2ddf333a26cf3228710ec88b64764d

                                                      Download Submit
                                                    • C:\Windows\SYSTEM.INI
                                                      Filesize

                                                      257B

                                                      MD5

                                                      3164438a418b42ff1ea0b63672beb620

                                                      SHA1

                                                      06b6e3ee58207baa5b134c9c259e11bc548c71bb

                                                      SHA256

                                                      1acffd3b7006cd0924638a3ed872e049f1db16b11f52fca388cc2c1963313263

                                                      SHA512

                                                      4c2790efedcb7b6aa258b1eb5d53fe2a9e922df209bc046f5909d29959dc82ca2c569592f3cab9eabdc8d5cf24eaae3cca3e85845bf410248e119bc469c51b9f

                                                      Download Submit
                                                    • C:\pxmby.exe
                                                      Filesize

                                                      100KB

                                                      MD5

                                                      34ff08b8f74f9e45f62fa4c97ad6c24e

                                                      SHA1

                                                      19f4316af540a8a023e78a8147de2f5a15ca5034

                                                      SHA256

                                                      0cabf821dda5b77301fec5dccbef200dfc2c50dc0b88d6bba2c3db86534ff028

                                                      SHA512

                                                      8bb9f4e895839ae0cd6859e0766416de7e90eacf900a7506b0f0169b53027cee127164e8b6e97d5e471bb489640a6fc2e340b48a8591e7c1f47e76a1b5d78212

                                                      Download Submit
                                                    • memory/244-49-0x0000000000400000-0x0000000000434000-memory.dmp
                                                      Filesize

                                                      208KB

                                                      Download
                                                    • memory/244-66-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/756-76-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-86-0x0000000000400000-0x0000000000460000-memory.dmp
                                                      Filesize

                                                      384KB

                                                      Download
                                                    • memory/756-78-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-72-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-75-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-74-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-84-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/756-207-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/756-87-0x0000000000400000-0x0000000000460000-memory.dmp
                                                      Filesize

                                                      384KB

                                                      Download
                                                    • memory/756-77-0x0000000002FC0000-0x000000000404E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-11-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-32-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-24-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-23-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-0-0x0000000000400000-0x0000000000460000-memory.dmp
                                                      Filesize

                                                      384KB

                                                      Download
                                                    • memory/1020-9-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-15-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-28-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-33-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-7-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-14-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-13-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-12-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/1020-10-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/1020-34-0x0000000004C80000-0x0000000004C81000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download
                                                    • memory/1020-16-0x0000000002FA0000-0x000000000402E000-memory.dmp
                                                      Filesize

                                                      16.6MB

                                                      Download
                                                    • memory/4364-61-0x0000000000430000-0x0000000000431000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download
                                                    • memory/4364-154-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/4364-46-0x0000000000400000-0x0000000000460000-memory.dmp
                                                      Filesize

                                                      384KB

                                                      Download
                                                    • memory/4364-65-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/4364-67-0x0000000077962000-0x0000000077963000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download
                                                    • memory/4364-97-0x0000000000070000-0x0000000000071000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download
                                                    • memory/4384-35-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/4384-5-0x0000000000400000-0x0000000000434000-memory.dmp
                                                      Filesize

                                                      208KB

                                                      Download
                                                    • memory/4972-6-0x0000000000400000-0x0000000000460000-memory.dmp
                                                      Filesize

                                                      384KB

                                                      Download
                                                    • memory/4972-94-0x0000000000030000-0x0000000000032000-memory.dmp
                                                      Filesize

                                                      8KB

                                                      Download
                                                    • memory/4972-95-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download
                                                    • memory/5044-152-0x0000000000400000-0x0000000000421000-memory.dmp
                                                      Filesize

                                                      132KB

                                                      Download
                                                    • memory/5044-93-0x0000000000430000-0x000000000044E000-memory.dmp
                                                      Filesize

                                                      120KB

                                                      Download
                                                    • memory/5044-99-0x0000000000070000-0x0000000000071000-memory.dmp
                                                      Filesize

                                                      4KB

                                                      Download