9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0

Analysis

max time kernel
150s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe
Size

160KB
MD5

40c4475a2214fe4ed99640535fc5e729
SHA1

ef0dee14059926d8ffd766d84ab113568a56dc39
SHA256

9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0
SHA512

d871e986ea9c5325a89d30ac00ecfe0dc137ac36a2aecee7b507faced27266753c05f1497bc764875bddcc660d96741b20f2f5c692fbde68c2b9bf266ea53d7a
SSDEEP

3072:bftffjmNoxE+KLNKAK36INbNoLar3pXoizGuy0:bVfjmN3xKXXoii

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3388	Logo1_.exe
2076	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe
File created	C:\Windows\Logo1_.exe	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5032	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	83
PID 2560 wrote to memory of 5032	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	83
PID 2560 wrote to memory of 5032	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	83
PID 2560 wrote to memory of 3388	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	84
PID 2560 wrote to memory of 3388	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	84
PID 2560 wrote to memory of 3388	2560	9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe	84
PID 3388 wrote to memory of 3204	3388	Logo1_.exe	85
PID 3388 wrote to memory of 3204	3388	Logo1_.exe	85
PID 3388 wrote to memory of 3204	3388	Logo1_.exe	85
PID 3204 wrote to memory of 232	3204	net.exe	88
PID 3204 wrote to memory of 232	3204	net.exe	88
PID 3204 wrote to memory of 232	3204	net.exe	88
PID 5032 wrote to memory of 2076	5032	cmd.exe	90
PID 5032 wrote to memory of 2076	5032	cmd.exe	90
PID 5032 wrote to memory of 2076	5032	cmd.exe	90
PID 3388 wrote to memory of 3484	3388	Logo1_.exe	56
PID 3388 wrote to memory of 3484	3388	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe
  "C:\Users\Admin\AppData\Local\Temp\9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD040.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe
      "C:\Users\Admin\AppData\Local\Temp\9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe"
      4⤵
      Executes dropped EXE
      PID:2076
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
89ce71c5c6300817a03a37bafa39829a

SHA1
db969b7339f46487b8c1f180df9d5805610df042

SHA256
bf62c9ac097226709d03d69880fe8150a50a4d88bd12b389f3cb1d0e4632dc05

SHA512
6050ac78d8f073bcdc359071630c78c4f0f3c1b7b1aef73ddedab637667d0bd29c139ea613008f1d23c04cc9ff5390fe6586480bedf7bef516b2f3e28e0b0b5c

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
b08dce0fc30c83b1bc500dac9950016d

SHA1
877994c8d8edc40431d08cd5c47b16ba4ccb594d

SHA256
d24ba479aa9f613b762d0c3490ff47e581796fb693db7a456c84f51ccb12e1a9

SHA512
4bc70050274b04d8b6aed4de713d918b2f3d160bf34f35195ad5c0fe58f3e75ed9685a9acff082a35f0ea48ebf5f9d224d6d3e4e861073bbc789bb8517cbc105

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
7c0581e2c34a99e0e6b7b63deb7540d8

SHA1
2ad688b178321284f2eab56ad02ef1d32e7ea46f

SHA256
200d8896a4cf3d442567696ff425b2aeca8b87428173337c4f5b9022ae0d6ab0

SHA512
4e65033131dd98ef1eb39d5da1c3a92b8d4c3ca083edb3db7bf9f555e57285f9f5c63bdc4d24cc5aa63312edd216ebc74c0a7f74ed38783e27998a2c013a496e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aD040.bat

Filesize
722B

MD5
1f32ad5b79285327175c2e0dde08fb23

SHA1
9b6f2d0e5b76e1c04557bee889706bff4a763c3f

SHA256
81e1ad910b7ca6fe0f33436666ddee9ea7842fc64468bbd0c03df3447a98fbd5

SHA512
cb96cf7d6e5f0ec5495141474e8558532679f1fbde600c8d578f0ead194be7fa9a3c6e8dcc07ca27c32f09825df568074fd0f246f76bf164305e716748541667

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a788fa743bcb028fca5b4ca5a1318edfb2b5c54d7cdb742840d907889cf79a0.exe.exe

Filesize
134KB

MD5
f16bdd638796008503118a4a1394509c

SHA1
fdd7c4fa0e69981f3dd7a1344bcef4743c4cd001

SHA256
5a41f028c171274052567a910f631ae91b46def95cd86f8a3be753e84407a8d7

SHA512
c8197d686e4dc392b5d3d192360f1d09b10dc254f8d99e4beea4e86b5044588785fc72ac12d563c38338ecbfd159e3ce536b33d82d1e01a2bce80744daecbadb

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
2c1e78088e7f1ffee9c2a8b59ff638c5

SHA1
85c8033a76e4c5b04b8ea09362cb36c746a7ccf6

SHA256
c29cf1bf7974eb92d48d9521f032a91210e71e44f19009b22029cf719de44b72

SHA512
96ca1dfe2ef4d844456a7c174703d7ba9423690f793714545085ed7185dad01be6fc603f188a6c8ebc8b93bd451710bf4962f686098e2908cc84743b94adbe3b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/2560-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2560-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-1227-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-4792-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-5231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download