32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe
Size

383KB
MD5

e65804994418a052338d85427bbb153f
SHA1

807adba6d73d5d8303dcff2eab7ae7dccdf46294
SHA256

32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71
SHA512

5282efdca23ac805b306d0f8e7a24af6242e17697a31efa6b1c222d5959a1ca3acf35cb5fe7424dc542a1a806c2dcc7c3f19bfc78ae0a6cc0f575d006e7be06d
SSDEEP

6144:eVfjmNE6x0Joevr9BIfamYnwA92lGJ5qyM4mF5sAOj/dxCzHa3sSC:g7+EA02evr/IfamWkSM4OSdxma3sSC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4164	Logo1_.exe
1520	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe
4164	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 3828	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	83
PID 1232 wrote to memory of 3828	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	83
PID 1232 wrote to memory of 3828	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	83
PID 1232 wrote to memory of 4164	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	85
PID 1232 wrote to memory of 4164	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	85
PID 1232 wrote to memory of 4164	1232	32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe	85
PID 4164 wrote to memory of 668	4164	Logo1_.exe	86
PID 4164 wrote to memory of 668	4164	Logo1_.exe	86
PID 4164 wrote to memory of 668	4164	Logo1_.exe	86
PID 668 wrote to memory of 4644	668	net.exe	88
PID 668 wrote to memory of 4644	668	net.exe	88
PID 668 wrote to memory of 4644	668	net.exe	88
PID 3828 wrote to memory of 1520	3828	cmd.exe	89
PID 3828 wrote to memory of 1520	3828	cmd.exe	89
PID 4164 wrote to memory of 3340	4164	Logo1_.exe	56
PID 4164 wrote to memory of 3340	4164	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Temp\32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe
  "C:\Users\Admin\AppData\Local\Temp\32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2913.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe
      "C:\Users\Admin\AppData\Local\Temp\32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe"
      4⤵
      Executes dropped EXE
      PID:1520
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
6cf75bac24310d701609e386f0e766c6

SHA1
1dc3a88a3e1121c2cd99a17cc41596628920d487

SHA256
deae3402f7aa4bc9bc0b995d08722b6f68cd593165671d90f7363212113b5b1d

SHA512
b71c35fa2afd0914aff753fb968a7a7e1fc94ae070d0eb8c1b21fa0f1b960dca804a9a2f2fd629dd11da294041664666554c0a01c55320d8d0d6d9509a9c8053

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
3c8ba6e916491723b0cd2a51de42d0ab

SHA1
46759e9921a899fd6e670b15bc97bfaa6e8618eb

SHA256
7ec42b7286657306c9eff30ebdbe5eda378d52076c9b335666a3ef12734bcad8

SHA512
c384ee4478d031caedc091e74e27415c22e6514efdd82e48c7d28c19d6158620a8001ef4dd0a270e8c84f2dc7e1fe0b3f3d176f2c29c66f460009c30fa56d37b

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
2500f702e2b9632127c14e4eaae5d424

SHA1
8726fef12958265214eeb58001c995629834b13a

SHA256
82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

SHA512
f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2913.bat

Filesize
722B

MD5
0e65fdcd9ebbb4a88f9ea9f19b43ff76

SHA1
a1046c466ef8b8eae846eab24290a7d499012506

SHA256
72c80d42d48ca19e0734ce9eadf43c73257d05145e5b17207ebf3e254bb66d48

SHA512
83f7a1c6be3f41f78b093eaab79c84f573b99de9c5e76dbed13cac3365d49bb5b5cb48620218ad801fba72fced308f597e670b6692c3eea50ff8caf1921de3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\32b081a3513e433491616fa426b97b6d725ec7d40671fba3f3626e53736cbf71.exe.exe

Filesize
356KB

MD5
bb2ed3324a0b2ce6475a7665bca1781b

SHA1
b6d37b71747bd9da38664cede374e3ae1cb8e55d

SHA256
6ff314c4a6e66d7ca4a34a345168affb21bc8ed2bfc17cb262730c2113d15cab

SHA512
79fd80daeef1638aa4e007c4659f573f183e2ffd4976f40e70e0efeb35fe4c5dfdba6cb467e0c1ee90fa2f4deee1a22d4bad715bf48e80c059bd8097f56bccbd

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
90358f0a6ccf1a1ef0f5c9a8e251f446

SHA1
c5f300842e15787d839eda797b5a203d7a2e7f99

SHA256
eefb6005f92be18cbc813a5d824572eebba6c4b7b1925822fec099344a75877c

SHA512
1f859a118791c8b757d930a060d643ab07b4523c4a264b102bba85341fe0322d54ba844d395ff6a84b3edc4d8790ee582fff9b2469a12bff0a75e11dc1f949af

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1232-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-1226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-4792-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4164-5231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download