4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe
Size

485KB
MD5

fb2357135fd0dd6da28cbe9916e9794f
SHA1

6de04a59386997d7a72d2b5f24f89850c7277a93
SHA256

4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066
SHA512

6d2825bff154c9cf3a089962c6a967ff762225959da8e12a5c9789128e9d20d5779e9eac67adc40b6fb2f36a23ac7bb075ec0858d1ccd02e2bc5732e3dd74110
SSDEEP

6144:+Fpuz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7E:Ypo1gL5pRTcAkS/3hzN8qE43fm78V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4272	Logo1_.exe
728	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4888	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	83
PID 1912 wrote to memory of 4888	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	83
PID 1912 wrote to memory of 4888	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	83
PID 1912 wrote to memory of 4272	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	84
PID 1912 wrote to memory of 4272	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	84
PID 1912 wrote to memory of 4272	1912	4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe	84
PID 4272 wrote to memory of 3092	4272	Logo1_.exe	85
PID 4272 wrote to memory of 3092	4272	Logo1_.exe	85
PID 4272 wrote to memory of 3092	4272	Logo1_.exe	85
PID 3092 wrote to memory of 2608	3092	net.exe	87
PID 3092 wrote to memory of 2608	3092	net.exe	87
PID 3092 wrote to memory of 2608	3092	net.exe	87
PID 4888 wrote to memory of 728	4888	cmd.exe	89
PID 4888 wrote to memory of 728	4888	cmd.exe	89
PID 4272 wrote to memory of 3540	4272	Logo1_.exe	56
PID 4272 wrote to memory of 3540	4272	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe
  "C:\Users\Admin\AppData\Local\Temp\4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3151.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe
      "C:\Users\Admin\AppData\Local\Temp\4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe"
      4⤵
      Executes dropped EXE
      PID:728
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
252KB

MD5
f0b698a8d0b18981e266778c961213e9

SHA1
e4d9e1b71ffb25109f0b2867fec168b5de1e1817

SHA256
d065ad01da4dda315895c5c13c12d45c9c9b4a846f4b3268d0cdb03d3ca6e1e5

SHA512
1c6bbdaf8af9c27bb9271ac0bbdda4ed34399e633ca90812cff6496a6678a7a08c6003b4f8838a6c66655ef5ed607518284c1caa0bd28eb52a45ceed314c27cb

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
571KB

MD5
8ac8af3d526585da59285e6a45e8c9e8

SHA1
01917d160cc9351cb6f6c704174d9e164a574a2c

SHA256
c009d1fe72d0c2137d50c0e8c0f0c1e88c7ad7f4e8a400655318b24000635224

SHA512
97b305e2e9a4ee00955d5f9dd4ee0a2f3e5c8ba58697d8f4991683b9a41713a3c89ff86ab3394bab6f1bffe610f6b65b7aefa8e38afe90b00c6229bc57cac1bf

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
637KB

MD5
9cba1e86016b20490fff38fb45ff4963

SHA1
378720d36869d50d06e9ffeef87488fbc2a8c8f7

SHA256
a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19

SHA512
2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a3151.bat

Filesize
722B

MD5
7f4b4b1178ee8bdcf6aee00dd7a5242e

SHA1
23531cfb93afa8648da0cd4972357e1d562b8f01

SHA256
f8d541eaefab6d328d4e6a55241ba14962c8dea499953a5de8495240ba0b2f62

SHA512
75d22852a8d4b59632272c256c98d02bcdf962e0045a72a1e152392b8310b0f7a56ed7f82e65acd66c4c1244e6823cb6a9097e141dd1b00c2d176b23c9a93925

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c269a9225f4475cd445b31c9ff3cf6e83e73d3f37dfdb19979e8c73bc97c066.exe.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\Logo1_.exe

Filesize
27KB

MD5
02b99e6376ac7c440ada9a035d4354d6

SHA1
6f6c7b1d4145a314e724f43f0d507dcdd1b0dd9e

SHA256
aef910aaa2fe7dcb2f3aa1c3e5ea1a7a2e9b77761716968e4838ccac05726397

SHA512
6b0ce6a03e764f0b883bd4170a7d199d69105b3780ac172450986e0a8036ab18a5c63bb2d1836daf999f711a48b1a0f81b6df5a593083f21960cdb60dbe909cc

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini

Filesize
9B

MD5
3ba8d99ae07bfe971a8f27f082803beb

SHA1
dbcc6b45ae3dc7be2faab524a0fc7415146f128d

SHA256
df296de0196b4b56afab78a4a7d68c1cffc9f7f91ebb05dde41f6c382dbd9af3

SHA512
ace344b467ecbdf133c69fd4ead288213167a0cd991088b987083df9a9a5b49d9c1588343a81fea32a5e7e3e3d621beaca6924bbcf92471578133c9c111785b5

Download Submit
memory/1912-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1912-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-27-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-37-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-1232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-20-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-4799-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-5238-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download