d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe
Size

4.0MB
MD5

a75283bc0aaee9ed8762dabaa635f1c7
SHA1

31679b4b4ca53b06da7a63a5bb63432f4cabe7df
SHA256

d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600
SHA512

a1007bc3d68e64c6896638c1edcf5921fae052ab24d7edae35ec51deb0b0cfe53188769905285ca62330e68b9249cc0686f9dee00797b8ba4638758553ecf669
SSDEEP

49152:fws/uynX9W06SSHXZvAOdf1LyvxXNmx/EapWxnjRDhel9YcFyInowXW5MTZzb:f3NfRI5wBElnxn6q

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3036	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2600	Logo1_.exe
2688	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe

Loads dropped DLL 1 IoCs

pid	Process
3036	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Journal\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe
File created	C:\Windows\Logo1_.exe	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe
2600	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3036	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	28
PID 2352 wrote to memory of 3036	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	28
PID 2352 wrote to memory of 3036	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	28
PID 2352 wrote to memory of 3036	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	28
PID 2352 wrote to memory of 2600	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	29
PID 2352 wrote to memory of 2600	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	29
PID 2352 wrote to memory of 2600	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	29
PID 2352 wrote to memory of 2600	2352	d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe	29
PID 2600 wrote to memory of 2732	2600	Logo1_.exe	31
PID 2600 wrote to memory of 2732	2600	Logo1_.exe	31
PID 2600 wrote to memory of 2732	2600	Logo1_.exe	31
PID 2600 wrote to memory of 2732	2600	Logo1_.exe	31
PID 2732 wrote to memory of 2772	2732	net.exe	33
PID 2732 wrote to memory of 2772	2732	net.exe	33
PID 2732 wrote to memory of 2772	2732	net.exe	33
PID 2732 wrote to memory of 2772	2732	net.exe	33
PID 3036 wrote to memory of 2688	3036	cmd.exe	34
PID 3036 wrote to memory of 2688	3036	cmd.exe	34
PID 3036 wrote to memory of 2688	3036	cmd.exe	34
PID 3036 wrote to memory of 2688	3036	cmd.exe	34
PID 2600 wrote to memory of 1224	2600	Logo1_.exe	12
PID 2600 wrote to memory of 1224	2600	Logo1_.exe	12

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe
  "C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe
      "C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe"
      4⤵
      Executes dropped EXE
      PID:2688
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
568f17750238ab463c745953a303648a

SHA1
25e9de37d6edb52c584c442e4f93a0448b4b37d4

SHA256
5351b82387339c78b116a077f2ba633da2a6fef86a165d92bfe28c2c3770ac81

SHA512
9034bc060e8155e07009d2142830f03b29c50525232fa1719038eae4fc742d460c5dad7b7fdd6957264c338072fbe71193a23d994510dc809ae240023b9f1ed3

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
82d95ff3c368229d3ecd547bfc2e95e4

SHA1
05c2c8065f243260792924168f85c614057119e8

SHA256
5fd8262ebaf159fa1ba5a2b80dad6f98477d1f549a651fc1a327f0dd207f2fdb

SHA512
27815b93d6070f7026c23ceac6210a78e694616d6a6a2012369b271e2d2ec986438f80dd3a29db4c4419b08084cb5a5914af216177669b86d8e2ae7184691699

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat

Filesize
722B

MD5
eba53aa6603fc5fb4fb65dc6efd3a4d4

SHA1
36b651bcfd219ee7e16755cf874207bd50a80596

SHA256
45384af92b7d1b2e119addcac3a72807e1f39169bc475685fe2443068fb4e6de

SHA512
3df10363acf31cb3ba6941dd6a2b3503175305ea39dad11f6e4294e3a8549a29608f048a442eae8dfbd0a476e82845b92033f1324ead6bec83c9d6e70b2b785e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat

Filesize
722B

MD5
eba53aa6603fc5fb4fb65dc6efd3a4d4

SHA1
36b651bcfd219ee7e16755cf874207bd50a80596

SHA256
45384af92b7d1b2e119addcac3a72807e1f39169bc475685fe2443068fb4e6de

SHA512
3df10363acf31cb3ba6941dd6a2b3503175305ea39dad11f6e4294e3a8549a29608f048a442eae8dfbd0a476e82845b92033f1324ead6bec83c9d6e70b2b785e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe

Filesize
3.9MB

MD5
640066423ccb8a3e8feaf63e0c093349

SHA1
94c7e7c25c4576b0b5eddd4b1faff813dbee7a0d

SHA256
bf713e3e5b7c209b0c1d458e705abc2cf3795997aa6df57e002bfe4e86290c1b

SHA512
850607a7f785c0c414d8c0b45b0a0245e01cad42c53ba0541051ad94a2f0265ae127a15fca916dd9af6b2a93a304bef4b5012f3f10cc32853b1067742822711e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe.exe

Filesize
3.9MB

MD5
640066423ccb8a3e8feaf63e0c093349

SHA1
94c7e7c25c4576b0b5eddd4b1faff813dbee7a0d

SHA256
bf713e3e5b7c209b0c1d458e705abc2cf3795997aa6df57e002bfe4e86290c1b

SHA512
850607a7f785c0c414d8c0b45b0a0245e01cad42c53ba0541051ad94a2f0265ae127a15fca916dd9af6b2a93a304bef4b5012f3f10cc32853b1067742822711e

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
886eb3bf6157b45d4a041e1e32608c70

SHA1
f476a007366ac0349789b0e803ec46be523f457a

SHA256
a0e9eac517b54fe732db8bf9ceeb76c64a43e2e53bfd18b5a4ab0f8475f3873b

SHA512
6e978385b23d3054695eaf2209e92591a667ccbde747f69cb63ae28f2db3a362d136bf16afb41ceb8eb304161cc698853f9cb825a26cc683e9a693d07c190fca

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
886eb3bf6157b45d4a041e1e32608c70

SHA1
f476a007366ac0349789b0e803ec46be523f457a

SHA256
a0e9eac517b54fe732db8bf9ceeb76c64a43e2e53bfd18b5a4ab0f8475f3873b

SHA512
6e978385b23d3054695eaf2209e92591a667ccbde747f69cb63ae28f2db3a362d136bf16afb41ceb8eb304161cc698853f9cb825a26cc683e9a693d07c190fca

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
886eb3bf6157b45d4a041e1e32608c70

SHA1
f476a007366ac0349789b0e803ec46be523f457a

SHA256
a0e9eac517b54fe732db8bf9ceeb76c64a43e2e53bfd18b5a4ab0f8475f3873b

SHA512
6e978385b23d3054695eaf2209e92591a667ccbde747f69cb63ae28f2db3a362d136bf16afb41ceb8eb304161cc698853f9cb825a26cc683e9a693d07c190fca

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
886eb3bf6157b45d4a041e1e32608c70

SHA1
f476a007366ac0349789b0e803ec46be523f457a

SHA256
a0e9eac517b54fe732db8bf9ceeb76c64a43e2e53bfd18b5a4ab0f8475f3873b

SHA512
6e978385b23d3054695eaf2209e92591a667ccbde747f69cb63ae28f2db3a362d136bf16afb41ceb8eb304161cc698853f9cb825a26cc683e9a693d07c190fca

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2085049433-1067986815-1244098655-1000\_desktop.ini

Filesize
9B

MD5
a496dc6e67a7c97fe6b5f93f052c5de1

SHA1
91d1cbd786e4ca543f5d364b42273efd1be384c5

SHA256
f656a696c47b2c37afecab6674210ad082849577f4763b778f81ca947bef3e63

SHA512
850c4fe29e0fa3388cb06d91a85330c1ac5eed337d23d2b6ee3d74142941dba27a49485ecf4a8cc73800c8c22d207b6586447ee3b20443f9a0e355614a6a1cb2

Download Submit
\Users\Admin\AppData\Local\Temp\d1ba113efef403279542c4094f1a70c86059c03b91ed230ba26b9d27e8175600.exe

Filesize
3.9MB

MD5
640066423ccb8a3e8feaf63e0c093349

SHA1
94c7e7c25c4576b0b5eddd4b1faff813dbee7a0d

SHA256
bf713e3e5b7c209b0c1d458e705abc2cf3795997aa6df57e002bfe4e86290c1b

SHA512
850607a7f785c0c414d8c0b45b0a0245e01cad42c53ba0541051ad94a2f0265ae127a15fca916dd9af6b2a93a304bef4b5012f3f10cc32853b1067742822711e

Download Submit
memory/1224-29-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/2352-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2352-12-0x00000000002D0000-0x0000000000306000-memory.dmp

Filesize
216KB

Download
memory/2352-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-46-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-99-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-1851-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-3311-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2600-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download