bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
Size

29KB
MD5

f927e5fde0dfcf57a6f3fe9ae8a06f66
SHA1

6ce2c8aaa52d35337d8badc47f4d689a80da18c7
SHA256

bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07
SHA512

6dbff3589e1cf5f634f0d08610486c6c9f88e92c6eb201cbeea5a30c2b3e01a2248d2eaa441846e6c15b60d17701dbe0cf307921cf2081b7a6590d285d90d89c
SSDEEP

384:NbbL+1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pO16GVRu1yK9fMnJG2V9dHS8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\X:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\R:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\P:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\K:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\H:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\Y:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\W:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\V:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\S:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\O:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\E:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\U:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\T:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\Q:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\M:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\L:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\I:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\G:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\N:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened (read-only)	\??\J:	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\es-ES\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\it-IT\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Google\Chrome\Application\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2448	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	28
PID 1504 wrote to memory of 2448	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	28
PID 1504 wrote to memory of 2448	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	28
PID 1504 wrote to memory of 2448	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	28
PID 2448 wrote to memory of 2096	2448	net.exe	32
PID 2448 wrote to memory of 2096	2448	net.exe	32
PID 2448 wrote to memory of 2096	2448	net.exe	32
PID 2448 wrote to memory of 2096	2448	net.exe	32
PID 1504 wrote to memory of 1204	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	18
PID 1504 wrote to memory of 1204	1504	bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe	18

C:\Users\Admin\AppData\Local\Temp\bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe
"C:\Users\Admin\AppData\Local\Temp\bca3437de621987841058ccb9894481d00072b92d1dc2028c83e4e4da6d68d07.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    PID:2096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zFM.exe

Filesize
876KB

MD5
751fb3baa92790f13bc71f7823dc1c42

SHA1
248674e8e9a78ee82f54e348116788d10dc47c14

SHA256
36d66bb0888a8c7b0d431bfd128579a8d43d7142ce1c1cef4172efbdbcb071dd

SHA512
721f96ee04196edfee4a5a08de1edbdac6c5988378fa4bf044ca1042afb53850a5e4e4dc8cba51dbf9cd9d5d74872ea28d448c1f90ec64e2fd637b3579dbdf77

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1528014236-771305907-3973026625-1000\_desktop.ini

Filesize
9B

MD5
12552b9021ecf1e73a82450bf9743eda

SHA1
2310e07e90a56edfc666f3b107bf20a44698d1e8

SHA256
d4edfeefd9fb37b8a99f9678d010a0325f6a4d03bcdf2a55de9d8366f1de907b

SHA512
452dd208242815c3c5f05c9accdc21923bcc2d7b304cbbb59352c087e4a8b9bb7f5d950fd5f3c1a44dd4426a018e7cd5e800c01c7ea650b55a18f753e686a0f2

Download Submit
memory/1204-5-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/1504-69-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-75-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-87-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-190-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-329-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download