fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
Size

154KB
MD5

6911e976059aace6b4c686d4c7f6c480
SHA1

1763f56620469fa4ac981a7d72a5b09f3ea8e3d0
SHA256

fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4
SHA512

904c5f8b8f359befaf57c0c6bd25947b126923ce022dfb0046c8b3d1712f96a74e5b2d03a6cbbe48c4fe4f5be2e9a39ec97a3a112131664ff1fc0440d97aff4d
SSDEEP

3072:pwkuJVLIaDcmjfamFQ1GJaRrzjq3DeZ+jThFkY:ruJ9cm1FQ1G8RrzmX+Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4328	Logo1_.exe
1384	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
File created	C:\Windows\Logo1_.exe	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe
4328	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 3700	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	83
PID 3808 wrote to memory of 3700	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	83
PID 3808 wrote to memory of 3700	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	83
PID 3808 wrote to memory of 4328	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	84
PID 3808 wrote to memory of 4328	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	84
PID 3808 wrote to memory of 4328	3808	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	84
PID 4328 wrote to memory of 3140	4328	Logo1_.exe	85
PID 4328 wrote to memory of 3140	4328	Logo1_.exe	85
PID 4328 wrote to memory of 3140	4328	Logo1_.exe	85
PID 3140 wrote to memory of 308	3140	net.exe	87
PID 3140 wrote to memory of 308	3140	net.exe	87
PID 3140 wrote to memory of 308	3140	net.exe	87
PID 3700 wrote to memory of 1384	3700	cmd.exe	89
PID 3700 wrote to memory of 1384	3700	cmd.exe	89
PID 3700 wrote to memory of 1384	3700	cmd.exe	89
PID 4328 wrote to memory of 1040	4328	Logo1_.exe	14
PID 4328 wrote to memory of 1040	4328	Logo1_.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1040
- C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
  "C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB163.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
      "C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe"
      4⤵
      Executes dropped EXE
      PID:1384
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aB163.bat

Filesize
722B

MD5
dba00991f70bbd6928c8aaf46f2f25ad

SHA1
6f09a03c94dcf028628a2191d5a075a0efb43a42

SHA256
6f315acfe8c55cf7b1e3d6382c2b280cfffe9506fb2fd166216bcbb80365050c

SHA512
b1633909b1db5f7363d9f94f02ea98c8a62dd1b985dfec6895bf5f2af0d41f58dc0712defa186e55da43eb84f2721e4e645384bd29827f9bd13db9f9f980a2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe

Filesize
124KB

MD5
e4d04d2074ee74c56c1e5b1b316ab026

SHA1
3cf6d88c3b3605e9e8fed5cb101c551c65aa9555

SHA256
0b025849ba2d45240a2fa0f41eed7a84e356bab87b6b2ae0bb34c583b8c1bcb4

SHA512
dc53937812646c7164726d872799a2e2ff7fbcbdaa3547aa928d51ebe95eed78cd310bbeacc7b7d924556375cf158694a1c59ee2fc2b4adaaad92e911e29a7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe.exe

Filesize
124KB

MD5
e4d04d2074ee74c56c1e5b1b316ab026

SHA1
3cf6d88c3b3605e9e8fed5cb101c551c65aa9555

SHA256
0b025849ba2d45240a2fa0f41eed7a84e356bab87b6b2ae0bb34c583b8c1bcb4

SHA512
dc53937812646c7164726d872799a2e2ff7fbcbdaa3547aa928d51ebe95eed78cd310bbeacc7b7d924556375cf158694a1c59ee2fc2b4adaaad92e911e29a7a6

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
memory/3808-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4328-140-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4328-145-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download