e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a

Analysis

max time kernel
152s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe
Size

46KB
MD5

df85a193391af5a8109126d3498f431e
SHA1

1650dd00ed72c445df5121c92206cce488fb866e
SHA256

e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a
SHA512

7231e282c72c98ce875b69020279e08965c856de78b64c9a294591cf8c6cf285b2472dcf821e8842b2d30ae0f1ce1fb5a09d8bcd64cc6bef250c79559d694a5d
SSDEEP

768:T1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL1nV9P8AGB2FZZfRDG74Uf2hLhM:JfgLdQAQfcfymNpV97Zfa4UfP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
228	Logo1_.exe
4360	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sl-SI\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe
File created	C:\Windows\Logo1_.exe	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe
228	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1656	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	83
PID 2448 wrote to memory of 1656	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	83
PID 2448 wrote to memory of 1656	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	83
PID 2448 wrote to memory of 228	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	84
PID 2448 wrote to memory of 228	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	84
PID 2448 wrote to memory of 228	2448	e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe	84
PID 228 wrote to memory of 4828	228	Logo1_.exe	85
PID 228 wrote to memory of 4828	228	Logo1_.exe	85
PID 228 wrote to memory of 4828	228	Logo1_.exe	85
PID 4828 wrote to memory of 5108	4828	net.exe	87
PID 4828 wrote to memory of 5108	4828	net.exe	87
PID 4828 wrote to memory of 5108	4828	net.exe	87
PID 1656 wrote to memory of 4360	1656	cmd.exe	89
PID 1656 wrote to memory of 4360	1656	cmd.exe	89
PID 228 wrote to memory of 3084	228	Logo1_.exe	20
PID 228 wrote to memory of 3084	228	Logo1_.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3084
- C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe
  "C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDA0.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe
      "C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe"
      4⤵
      Executes dropped EXE
      PID:4360
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\InvokeAdd.exe

Filesize
371KB

MD5
f06e290a4aeb5f84d2236fa8c9432d6b

SHA1
4033de036e2347970002cf410b4e0938e0b0f8e0

SHA256
170f28511c7b0c687509228b04e592f596a921973337ce62fafa96d3ec04cd72

SHA512
df2f90a1fb3aba8e18bb24e35504bc661f39e824b3c020f62579fa1c3666193e0eb22846692f2419d80c931fc80046bff99126020ab2a61d351a4ecb28fcf5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aCDA0.bat

Filesize
722B

MD5
8b677916aa43fd3643e48fc03789b691

SHA1
83c8624031da332f2e31b533f942e3b0c9ee984f

SHA256
34b6b37781fb6fa324e242ca485b48cf428fa4237f18e050ac5860ad867acbb9

SHA512
ed1a929f55794bee1fd797634b5c3be1e509ad7545b218fc106d7156e5259d968b06fd6c8d1ce140211ebc286cc21ce86decc2aaff19dc34250841f23ea28099

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe

Filesize
20KB

MD5
fd5810b26ebdf2dbe069d80da8fd516d

SHA1
4bc0dd41a1ea87c34e5064bdaf28ab2ee063971a

SHA256
9ba18aa5e07ebd262d74412cca6e78bbd3c627d88f55555ad91e4038661f9fd1

SHA512
4f36deee6cfd5411b57aa5496de4d11eed020470142dee1543aef61279f8b36fe97ec5074fa3c104d977f7402a3a89a0faabc8b6b4aa485890d8a45bcc1b11e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6f2778a3931e4ae5ba120a399ee4ff4e76fd8befb0d2686148fac1fb864955a.exe.exe

Filesize
20KB

MD5
fd5810b26ebdf2dbe069d80da8fd516d

SHA1
4bc0dd41a1ea87c34e5064bdaf28ab2ee063971a

SHA256
9ba18aa5e07ebd262d74412cca6e78bbd3c627d88f55555ad91e4038661f9fd1

SHA512
4f36deee6cfd5411b57aa5496de4d11eed020470142dee1543aef61279f8b36fe97ec5074fa3c104d977f7402a3a89a0faabc8b6b4aa485890d8a45bcc1b11e4

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c4f76c9eda83b93db5b8a64720cdc172

SHA1
84eddd03d7bb3586dde4ed85e59ce23a8a2bad9a

SHA256
f143b0bce17d7d8085692349cfb5427e4d51a89b93adacbd8305fa33fe208d09

SHA512
09169199ddade2f2a35496497ad882cf6350057e47cb21145f6a33e3270f7f844ca8592cf585970b00087bcc76e3784283f0bb4c4dc42fdada534f8043ceafa2

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c4f76c9eda83b93db5b8a64720cdc172

SHA1
84eddd03d7bb3586dde4ed85e59ce23a8a2bad9a

SHA256
f143b0bce17d7d8085692349cfb5427e4d51a89b93adacbd8305fa33fe208d09

SHA512
09169199ddade2f2a35496497ad882cf6350057e47cb21145f6a33e3270f7f844ca8592cf585970b00087bcc76e3784283f0bb4c4dc42fdada534f8043ceafa2

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
c4f76c9eda83b93db5b8a64720cdc172

SHA1
84eddd03d7bb3586dde4ed85e59ce23a8a2bad9a

SHA256
f143b0bce17d7d8085692349cfb5427e4d51a89b93adacbd8305fa33fe208d09

SHA512
09169199ddade2f2a35496497ad882cf6350057e47cb21145f6a33e3270f7f844ca8592cf585970b00087bcc76e3784283f0bb4c4dc42fdada534f8043ceafa2

Download Submit
C:\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
memory/228-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-1279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-1540-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-2595-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2448-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2448-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download