da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
Size

5.7MB
MD5

66f3f09e75650982b397980063850ff8
SHA1

31636c08b952d0cc939098c4a6a822144497adff
SHA256

da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef
SHA512

eab67c6eb573dcc0748e81702d9e7217661073a46f51835c54856128516810421e8c57e4473a8bd822b8682e2aaabb5a3702a216b588eaebd3c11154eeb0dec6
SSDEEP

49152:jBr9Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dr:jzKUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2600	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2100	Logo1_.exe
2632	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe

Loads dropped DLL 1 IoCs

pid	Process
2600	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Media Player\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
File created	C:\Windows\Logo1_.exe	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe
2100	Logo1_.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1576	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	28
PID 2120 wrote to memory of 1576	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	28
PID 2120 wrote to memory of 1576	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	28
PID 2120 wrote to memory of 1576	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	28
PID 1576 wrote to memory of 1704	1576	net.exe	30
PID 1576 wrote to memory of 1704	1576	net.exe	30
PID 1576 wrote to memory of 1704	1576	net.exe	30
PID 1576 wrote to memory of 1704	1576	net.exe	30
PID 2120 wrote to memory of 2600	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	31
PID 2120 wrote to memory of 2600	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	31
PID 2120 wrote to memory of 2600	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	31
PID 2120 wrote to memory of 2600	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	31
PID 2120 wrote to memory of 2100	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	32
PID 2120 wrote to memory of 2100	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	32
PID 2120 wrote to memory of 2100	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	32
PID 2120 wrote to memory of 2100	2120	da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe	32
PID 2100 wrote to memory of 2708	2100	Logo1_.exe	34
PID 2100 wrote to memory of 2708	2100	Logo1_.exe	34
PID 2100 wrote to memory of 2708	2100	Logo1_.exe	34
PID 2100 wrote to memory of 2708	2100	Logo1_.exe	34
PID 2708 wrote to memory of 2660	2708	net.exe	36
PID 2708 wrote to memory of 2660	2708	net.exe	36
PID 2708 wrote to memory of 2660	2708	net.exe	36
PID 2708 wrote to memory of 2660	2708	net.exe	36
PID 2100 wrote to memory of 2872	2100	Logo1_.exe	38
PID 2100 wrote to memory of 2872	2100	Logo1_.exe	38
PID 2100 wrote to memory of 2872	2100	Logo1_.exe	38
PID 2100 wrote to memory of 2872	2100	Logo1_.exe	38
PID 2872 wrote to memory of 2644	2872	net.exe	40
PID 2872 wrote to memory of 2644	2872	net.exe	40
PID 2872 wrote to memory of 2644	2872	net.exe	40
PID 2872 wrote to memory of 2644	2872	net.exe	40
PID 2100 wrote to memory of 1232	2100	Logo1_.exe	21
PID 2100 wrote to memory of 1232	2100	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
  "C:\Users\Admin\AppData\Local\Temp\da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2349.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe
      "C:\Users\Admin\AppData\Local\Temp\da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe"
      4⤵
      Executes dropped EXE
      PID:2632
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2660
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
68a4dfa7dbc99531f82e6cce0ea46f51

SHA1
40d1d62774f2b4e3f483444cd5fe015f86fe6a3d

SHA256
ca248b107e73f63e558839d014269d85355f48defd1b4a13d7235897693578c2

SHA512
48ce880ea1da10902b30f181494bb1191baf71cf7d0be6ea1aa52f6d73ed0f8c462a3890acaec7922614a33529501daff3d791eacedbfc18ccf50ac35adb7b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2349.bat

Filesize
722B

MD5
3e3c7bdc8f0bd54b09f3016269d6e1c7

SHA1
a0a0b43b5665706cb75a25ffcdbb54f688aa7a2f

SHA256
d62c64339984c6af924a5c6c4633da390a72394315240c692c3adca7bda4cbf3

SHA512
063e765f98efcf3f7eb70fca46140aad79d4ea372dbc1813fa7272cb1d9397257ca4511c67edd680ad0e4f88fdd3d708d7fa32563437b68ed7cc8aebd081e3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\da13b40d94c38312ff2daa91c49af40066a00b606160ee2fe0f9567a6e22a6ef.exe.exe

Filesize
5.7MB

MD5
ba18e99b3e17adb5b029eaebc457dd89

SHA1
ec0458f3c00d35b323f08d4e1cc2e72899429c38

SHA256
f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

SHA512
1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
71f849213684b8972a6360ecd86478d8

SHA1
80eb51dcee61f6be6229d211207bb837156e7cd8

SHA256
1319c00466a751094210e18ef09267c2a5db0235fbb18b18df97c787a6b8865f

SHA512
6b062e9a7aac186e627cd20edcecfc78ce781d993058b93138898c01332ca66f70e1dd826b85f29486f66f805d29c8a708f8aa539a26a18a57831aa53f998e84

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\_desktop.ini

Filesize
9B

MD5
4d28283e4d415600ffc2f8fda6d8c91e

SHA1
053dcb8d5d84b75459bc82d8740ee4684d680016

SHA256
b855effeaf01610130d3f38de35bc7f98bfc6643d98d4198af18534f048e8df7

SHA512
73a758cd5e5ac48d62dd89719be604214895e0cc9a10ff7464a6cf9161a37fd27d15dd2d2565f18198b381ac6442bcb36f38614df7b1176061a83616517a7edb

Download Submit
memory/1232-27-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/2100-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2100-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2100-3342-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2100-4173-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2120-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2120-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download