0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
Size

227KB
MD5

a4beb9a2482f287d735062783fee91a7
SHA1

5baea2317e8bac3f089365e62eca4d2e4c7f5c2e
SHA256

0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310
SHA512

422f860ecb16586d20eb62767b7173cbdc8271735745202f8598c4db7a88a56775efa40dcd88cbfdaeb074751ce6e5353176624e0f5a36c0a07a56b547219404
SSDEEP

3072:pTkuJVLUdeKzC/lzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5n:SuJWdeKzC/leySe8AIqpoHbnDns1ND9m

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2232	Logo1_.exe
1800	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Multimedia Platform\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
File created	C:\Windows\Logo1_.exe	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe
2232	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2852	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	85
PID 3492 wrote to memory of 2852	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	85
PID 3492 wrote to memory of 2852	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	85
PID 3492 wrote to memory of 2232	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	86
PID 3492 wrote to memory of 2232	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	86
PID 3492 wrote to memory of 2232	3492	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	86
PID 2232 wrote to memory of 4896	2232	Logo1_.exe	87
PID 2232 wrote to memory of 4896	2232	Logo1_.exe	87
PID 2232 wrote to memory of 4896	2232	Logo1_.exe	87
PID 4896 wrote to memory of 2996	4896	net.exe	90
PID 4896 wrote to memory of 2996	4896	net.exe	90
PID 4896 wrote to memory of 2996	4896	net.exe	90
PID 2852 wrote to memory of 1800	2852	cmd.exe	91
PID 2852 wrote to memory of 1800	2852	cmd.exe	91
PID 2852 wrote to memory of 1800	2852	cmd.exe	91
PID 2232 wrote to memory of 3444	2232	Logo1_.exe	56
PID 2232 wrote to memory of 3444	2232	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
  "C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C0D.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
      "C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe"
      4⤵
      Executes dropped EXE
      PID:1800
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
fb33dbc4b5d5b31cf6058c1bcb2c0816

SHA1
0c0d5e2fff30026710694fe21cf9b22378413fe1

SHA256
44b6bae974236d6f36331839d21b67cd74b6d57fe01937edbc393863a83d2197

SHA512
4069f91e24f71d92313a6acbf6a52f173cd71077fb8bea412bf98b68324627a72e6b6d0b755cb2b7f08fd56cd9ace4c4d65c2370d8842cf55361cfbfef79ba7f

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
b2316b7bf620ef9f3fb9a079b178d128

SHA1
0f418eca1c8ef18e91a5139fb51c6c7fca1bf29c

SHA256
7a3fc5e94d158a5afc7bbaeb25985e395025947f42a6d5858a675fcddf7ad5f3

SHA512
4740dc4b3a97038ef0263c03ae69105c4e845787f6953f6648126a5a6711528c2bf99433700142ff12a8fdef5bbe0797c872e4780db4d63494b6f82a9ff8de4d

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
73b84e696764a6109051d306b9e13984

SHA1
4649e99be02adfdd0d844013b3bc61be85ae28bf

SHA256
ab5e87fc7a7d616a677f0a69f1eb858322f1c14defa4ea04b9fd05f0c7e166de

SHA512
1692b47b0f9743a6160134849323e518f5f7689edf8b8bae17385354d034b307c29a0793652ed89c7a6df6e8fd21d59525620ed6176542bd8607e9938788b680

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a4C0D.bat

Filesize
722B

MD5
abc5c70bea965a8376f69ea327f65a5f

SHA1
49de650b63b9ac616a4bb9802611e6c0f359884a

SHA256
caa6e90f1875fcd828c381c86366d8ecfc89684d5767eaf96ba4683cda12b376

SHA512
a7b47d747647db20ffad1a942c9343183cf114cd0bfb9971c3b2d512e31ceb169b9de343442f2998aaeb6cea5d28d4c16f34def6b259a89a4b962b0a47406f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe.exe

Filesize
198KB

MD5
e133c2d85cff4edd7fe8e8f0f8be6cdb

SHA1
b8269209ebb6fe44bc50dab35f97b0ae244701b4

SHA256
6c5e7d9c81a409e67c143cd3aed33bddc3967fa4c9ab3b98560b7d3bf57d093d

SHA512
701b7d1c7e154519d77043f7de09d60c1ff76c95f820fc1c9afca19724efb0847d646686053354156fd4e8a9dab1f29a79d3223f939a3ff1b3613770dc8603b1

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
2151384a3dd2ba8bf06344750c79ec50

SHA1
9a11f78359b6e63f377e53d4b8f6729973108352

SHA256
dcb31868a407145437cddb08a1bd348abf98b690abae375ce417fdd74b016eec

SHA512
30ba1c9309e477250ae60c96a7d046eb683c31ae57520a539bb5f668142b2f8fb51a4cde02b39d6bf149a6dbd68b9a1478a569aaaa75667927c5fcbcdafa4677

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2288054676-1871194608-3559553667-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/2232-26-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-36-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-1078-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-1227-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-4792-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2232-5231-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3492-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3492-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download