Overview

overview

10

Static

static

3

2025-03-04...er.exe

windows7-x64

10

2025-03-04...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2025, 16:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe

  • Size

    3.6MB

  • MD5

    0c0564a8ae6be0a027896193e6ec5cb6

  • SHA1

    e4f126b1e13bbef334e93c954d2ef00b37aad5f8

  • SHA256

    222f541e0e7a8a986b85349f6f23d198e708be76508d1c3875ca8535585fb3f7

  • SHA512

    69e5785ffc043ccc66e9e2bcc254084b7495bffcf7d9f792eb3990f36db1cf258c7ae91a4b19719f0c6b3e1ac84e0706d7865e2edbc2b1fede2832d06a3762f3

  • SSDEEP

    49152:VCwsbCAN7KXferL7Vwe/Gg0P+WhxUExuqrQLutI+MWB:Iws2AN7KXOaeOgmharqrQLuuE

Score
10/10
gh0stratpurplefoxsalitybackdoordefense_evasiondiscoverypersistenceratrootkittrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:796
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:64
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3040
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3064
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3164
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3452
                  • C:\Users\Admin\AppData\Local\Temp\2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4080
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      3⤵
                      • Server Software Component: Terminal Services DLL
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      PID:2672
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5084
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5028
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          5⤵
                            PID:2292
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 2 127.0.0.1
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3388
                      • C:\Users\Admin\AppData\Local\Temp\HD_2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe
                        C:\Users\Admin\AppData\Local\Temp\HD_2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5008
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                    1⤵
                      PID:3588
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      1⤵
                        PID:3756
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3852
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          1⤵
                            PID:3960
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4048
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:2240
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                1⤵
                                  PID:2508
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  1⤵
                                    PID:4400
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                    1⤵
                                      PID:1848
                                    • C:\Windows\system32\backgroundTaskHost.exe
                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                      1⤵
                                        PID:4004
                                      • C:\Windows\SysWOW64\svchost.exe
                                        C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
                                        1⤵
                                          PID:2516
                                        • C:\Windows\SysWOW64\svchost.exe
                                          C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
                                          1⤵
                                          • Loads dropped DLL
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3244
                                          • C:\Windows\SysWOW64\Remote Data.exe
                                            "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240625484.txt",MainThread
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            PID:1588
                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                          C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                          1⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2000
                                          • C:\Windows\SysWOW64\TXPlatfor.exe
                                            C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                            2⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Executes dropped EXE
                                            • Suspicious behavior: LoadsDriver
                                            PID:880
                                        • C:\Windows\System32\RuntimeBroker.exe
                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          1⤵
                                            PID:4648
                                          • C:\Windows\System32\RuntimeBroker.exe
                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            1⤵
                                              PID:3204
                                            • C:\Windows\system32\backgroundTaskHost.exe
                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                              1⤵
                                                PID:3884

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Replication Through Removable Media

                                              1
                                              T1091

                                              Execution

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Server Software Component

                                              1
                                              T1505

                                              Terminal Services DLL

                                              1
                                              T1505.005

                                              Privilege Escalation

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Defense Evasion

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Impair Defenses

                                              4
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Disable or Modify Tools

                                              3
                                              T1562.001

                                              Modify Registry

                                              6
                                              T1112

                                              Credential Access

                                              Discovery

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              1
                                              T1012

                                              Remote System Discovery

                                              1
                                              T1018

                                              System Information Discovery

                                              3
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Network Configuration Discovery

                                              1
                                              T1016

                                              Internet Connection Discovery

                                              1
                                              T1016.001

                                              Lateral Movement

                                              Replication Through Removable Media

                                              1
                                              T1091

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Temp\0E59547F_Rar\2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe
                                                Filesize

                                                3.5MB

                                                MD5

                                                71ace6af21297396dff2770d7184450a

                                                SHA1

                                                24acacdcd61722196fa4e690f319a91b05ba2b3d

                                                SHA256

                                                8cd99a09bad134559af5846b055d831f1ebf376c2de5d044d885828e89ccbdb6

                                                SHA512

                                                c9f0aba06fd88b258c769da6eb0cbcf4097b90644ba00e608cc757f98f9a785ae85b7e0c5a6320fc03e8c202e0f3980ad1c174098e916719f4030f8ca7a98432

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\HD_2025-03-04_0c0564a8ae6be0a027896193e6ec5cb6_hijackloader_icedid_luca-stealer.exe
                                                Filesize

                                                1.0MB

                                                MD5

                                                50ae4ec8a0671ff663c046ca6e091b2e

                                                SHA1

                                                c674e89292e0d23dd920a66ed26a08c6a64ceb17

                                                SHA256

                                                2b2eeec85d6c648857e3d4d4e9d6169a71b9e3862cd134e288583b894adf2554

                                                SHA512

                                                5276479139429790637a91d3505824b8ecf430d5294aa61b4ac7b223c703c214af204ef6e0e8a33d2d261d5c063e2c03df5983c7b329cc1fe428bda72060e7d5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\HD_X.dat
                                                Filesize

                                                2.5MB

                                                MD5

                                                7b3b7ea4dabfdab15f1511859a16a8b8

                                                SHA1

                                                e8a52741ee08a229fe90bb48b28f8c6b0b631d90

                                                SHA256

                                                23a241dd57f42c70f20107d69428c8b2784a4c10ec0b9c44d66a57054b8205fc

                                                SHA512

                                                bedd8f03cfe9487ad1012079e16c0777b78fe02b1c1b9d8d87990889ceffa780b612265d3ebc36fc1250d8cc1c74a9248bd2635db284b94cbe9a3a7a5e15252f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                Filesize

                                                377KB

                                                MD5

                                                4a36a48e58829c22381572b2040b6fe0

                                                SHA1

                                                f09d30e44ff7e3f20a5de307720f3ad148c6143b

                                                SHA256

                                                3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

                                                SHA512

                                                5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                Filesize

                                                941KB

                                                MD5

                                                8dc3adf1c490211971c1e2325f1424d2

                                                SHA1

                                                4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

                                                SHA256

                                                bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

                                                SHA512

                                                ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

                                                Download Submit

                                              • C:\Windows\SysWOW64\240625484.txt
                                                Filesize

                                                899KB

                                                MD5

                                                6ca9197b1d490a9cabd6b475b1883c27

                                                SHA1

                                                5e1d7a878bbc0efd5e18fa613d34d5e76f13c025

                                                SHA256

                                                6352c33ff0f5a52955b31116e24360e3c744b53debf81086dd1a6c2925662f44

                                                SHA512

                                                54b4b740b1d506951420494c1fde94a91bf1f89857f26d5241f3d367c36328141eb43323a4a5571587ee211c03505d8b4ed3b5ebc4b97435f509b0669cc546bc

                                                Download Submit

                                              • C:\Windows\SysWOW64\Remote Data.exe
                                                Filesize

                                                60KB

                                                MD5

                                                889b99c52a60dd49227c5e485a016679

                                                SHA1

                                                8fa889e456aa646a4d0a4349977430ce5fa5e2d7

                                                SHA256

                                                6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

                                                SHA512

                                                08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

                                                Download Submit

                                              • F:\qtbjjd.exe
                                                Filesize

                                                100KB

                                                MD5

                                                d8909a691489e11f8b8f050c81129a0e

                                                SHA1

                                                4720dd437c2a48dddee31939cb347144fdb64fcc

                                                SHA256

                                                57e9c0ff8e271acc8ca900f29442ca5b77ab3a326fdf8b4bfadde670ce0b6472

                                                SHA512

                                                740bc7b451f03df7e7f4a6fc642497ccf049df84836667344e52ab5a4d7705759753258c9f8876263a790bdcf83f9e6b3ccd695e520421f6dcdb97ad5e58b307

                                                Download Submit

                                              • memory/880-80-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/880-61-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/880-78-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/2000-50-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/2000-52-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/2000-53-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/4080-13-0x0000000000780000-0x0000000000782000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4080-100-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-9-0x00000000007A0000-0x00000000007A1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4080-8-0x0000000000780000-0x0000000000782000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4080-11-0x0000000000780000-0x0000000000782000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4080-3-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-15-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-12-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-0-0x0000000000400000-0x00000000006AC000-memory.dmp

                                                Filesize

                                                2.7MB

                                                Download

                                              • memory/4080-10-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-39-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-1-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-40-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-162-0x0000000000400000-0x00000000006AC000-memory.dmp

                                                Filesize

                                                2.7MB

                                                Download

                                              • memory/4080-4-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-14-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-7-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-60-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-5-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-114-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-111-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-84-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-109-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-85-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-90-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-91-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-92-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-93-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-95-0x0000000000780000-0x0000000000782000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4080-96-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-98-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-6-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-103-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-104-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4080-108-0x0000000002660000-0x00000000036EE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/5028-86-0x0000000000DD0000-0x0000000000DD2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/5028-83-0x0000000000DD0000-0x0000000000DD2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/5028-82-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5084-36-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/5084-35-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/5084-33-0x0000000010000000-0x00000000101B6000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download