ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe
Size

2.7MB
MD5

5212f5e971e925dd07adf15af8a17376
SHA1

927b1054b00c07447dd05e7e89550ffc685d1db8
SHA256

ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221
SHA512

17c7beb748d159cd9753d403a5f27bf63b769ca12bf06eb481ded61e7e939b225eae4cd1f6f05ec18a38860cf399d4e15c3f2eeffb39a19f5df7efdab37fb57c
SSDEEP

49152:KlI7bphcx1u9DSegx9T3JuabFjv3NGOaedbokObZCcP9:fbpqHV/9TZzFjvvJiP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2252	Logo1_.exe
976	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Assets\XboxGameBar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe
File created	C:\Windows\Logo1_.exe	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe
2252	Logo1_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 4000	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	83
PID 656 wrote to memory of 4000	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	83
PID 656 wrote to memory of 4000	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	83
PID 656 wrote to memory of 2252	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	84
PID 656 wrote to memory of 2252	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	84
PID 656 wrote to memory of 2252	656	ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe	84
PID 2252 wrote to memory of 3724	2252	Logo1_.exe	87
PID 2252 wrote to memory of 3724	2252	Logo1_.exe	87
PID 2252 wrote to memory of 3724	2252	Logo1_.exe	87
PID 3724 wrote to memory of 5084	3724	net.exe	90
PID 3724 wrote to memory of 5084	3724	net.exe	90
PID 3724 wrote to memory of 5084	3724	net.exe	90
PID 2252 wrote to memory of 3388	2252	Logo1_.exe	56
PID 2252 wrote to memory of 3388	2252	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe
  "C:\Users\Admin\AppData\Local\Temp\ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a321C.bat
    3⤵
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe
      "C:\Users\Admin\AppData\Local\Temp\ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe"
      4⤵
      Executes dropped EXE
      PID:976
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3724
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
182a1efac234be152c673103584b3add

SHA1
1606a8d53426ba27ede4b18d13acbbef1697efeb

SHA256
451c03fad8659d2d4599148b14036f011eee1b09148a92c788d838aa372a8ced

SHA512
da708d9792c5a1cb66113400529c8c2dc548299fe90022bde3c7c03c3e0a7c5926b8079ea3a6065801ab01e2418cbffffac667ba72bdb650f21aba9b05a0b2b8

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
df2ea083f9bf31bbd8f3644e90e2b4e7

SHA1
70a8690904eb5a5da503f43759b5cb80d2838a6d

SHA256
554486c45097e6aad0e2f63f05c018d6e19a91fcedf6c56ae3b4e1b7ffdf46db

SHA512
d99a22e3d2909826b2381043fb23bb7dcc02348cda0022c7356dbf958c97ed6aff1e1571f2c0c334415b1e376b149eca674c1ff7d0a426d017c3071eea810afa

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
ff7ce6c4ffc92d1beca4883dfcfde0af

SHA1
4a52e320cd88765f13e2799a4980a12f788c98a4

SHA256
5a4e150d03f1cfadccd40a407a3ae8ec5ffbb5d28ea95dca136d67cac24fd8b5

SHA512
99056bcbb382e545304a33002a6cfbb7a57df663feca5a3842bf077d1126931ba78d5e04a93cbd72a7c6d9eb09005750e5cff1030d8586e26838e7634d7ad583

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a321C.bat

Filesize
722B

MD5
34d4638b7ed76c441d2cfdb79270f7a1

SHA1
cf2c5e7683aca2a32b184b8c7ebfd608ce8c6a6b

SHA256
da63690b990507489dca8901f5e578fbac8824600ee35d37d9bd166ef2d54448

SHA512
001fce4545247e8a9af5d0adedac0e025389c27d26013c6de10331b4f664670c06958430be46c682e0ce03d92979e2c0deeb27266b87b476112210efa50c3d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac52a9fd9be02e599fa6bc28cdd84ef80a584b67bd0a657c8a54b9e8633ae221.exe.exe

Filesize
2.7MB

MD5
97194fd7c69a4567bc31c979c690b0af

SHA1
cffb41f6593ccd46a4a8a0469c7d60d5d7fcec88

SHA256
6931d5c2c509314bb48c9d28eff255163d5c1875c76666b0c9611467ded323ae

SHA512
be6a4efa49a7834d5ef95405e28a642c3ace0f3b1374ab5acce76d8a74316e321ef693e3afe64320f9b613ba740dd793db3e39a06e329b2fd474ec5687fe0e81

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
34b640fa0177319ac442b6f3bbdaac54

SHA1
174c06017aeaceaab18228ca8eead4f7e94e58a2

SHA256
e0520317e9229269c4ab52b7690e1c289c2d3f9284f651c3f9d7d6abd1e49207

SHA512
2cbe13eff0bb3b532c33efc8aa781951adfc256ad96a0e32ffdb37f4eded8d474a0b3a143d50a9a4ca1f3938eb8f0a09a1333278eb211b5cc2c0466173244d9a

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\_desktop.ini

Filesize
9B

MD5
5e45e0c42537212b4bfef35112ec91ba

SHA1
10c59c091fd35facc82bbc96938f118ce5a60546

SHA256
9f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5

SHA512
ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb

Download Submit
memory/656-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/656-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-26-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-36-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-1227-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-4792-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2252-5231-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download