4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
Size

341KB
MD5

fb648981e436882a181ae1edf0f65e66
SHA1

7bed8cbe0589d99c1764c00906c75cd0e0c7113f
SHA256

4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50
SHA512

0da837f8d1a42e063da2b0054c3fd6937d4acbec62ae2e93970ac0341be09238eb20fc6d6ff127d43464e8d3f2d2fd42128dda8bbd510e32f569fec71d041c71
SSDEEP

6144:TVfjmN7juXfo9e3/QCeve3XoQupt55EhtcxtpiO11ivncfQivI5:p7+7jQJeve3Gpt55VR/onQQivI5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2156	Logo1_.exe
3416	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
File created	C:\Windows\Logo1_.exe	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe
2156	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 5092	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	83
PID 564 wrote to memory of 5092	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	83
PID 564 wrote to memory of 5092	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	83
PID 564 wrote to memory of 2156	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	84
PID 564 wrote to memory of 2156	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	84
PID 564 wrote to memory of 2156	564	4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe	84
PID 2156 wrote to memory of 1028	2156	Logo1_.exe	85
PID 2156 wrote to memory of 1028	2156	Logo1_.exe	85
PID 2156 wrote to memory of 1028	2156	Logo1_.exe	85
PID 1028 wrote to memory of 3896	1028	net.exe	88
PID 1028 wrote to memory of 3896	1028	net.exe	88
PID 1028 wrote to memory of 3896	1028	net.exe	88
PID 5092 wrote to memory of 3416	5092	cmd.exe	89
PID 5092 wrote to memory of 3416	5092	cmd.exe	89
PID 2156 wrote to memory of 3548	2156	Logo1_.exe	56
PID 2156 wrote to memory of 3548	2156	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3548
- C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
  "C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37E8.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
      "C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"
      4⤵
      Executes dropped EXE
      PID:3416
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
ea3e7a80029fb4b8eaf381d61f94eb7e

SHA1
542cffe191c68dba2679f9e167d3f1e2c96a06f3

SHA256
f7d095c63ade32f4ba12501fb85ffb9f959d83c1e47076f2a05892339735715d

SHA512
0ee9e7288ea1fb905f14cf4983f1f591409ec671bef6f45b134aea0bdd8b0ba62251c77aa401a049b172b269cb442aa21fd4ae66730d137609e95e580d6a52bd

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
fe9a9d039e0e14684811f12824003b14

SHA1
bbf335b2c7cd937c0e9904345ab06f1dee36f256

SHA256
092a833945f414a5d27612b0c5e7ee7ba4e5f2f990d77fd6c02fc1a2800438e9

SHA512
0349d2c63837ab07474981bb3348aa8c927c322cf70182c3719ebab663a3604a8293de385bb419f8af0783c2ce4b54028de93b833b6df8a551fbf9d35312ccc4

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
7c0581e2c34a99e0e6b7b63deb7540d8

SHA1
2ad688b178321284f2eab56ad02ef1d32e7ea46f

SHA256
200d8896a4cf3d442567696ff425b2aeca8b87428173337c4f5b9022ae0d6ab0

SHA512
4e65033131dd98ef1eb39d5da1c3a92b8d4c3ca083edb3db7bf9f555e57285f9f5c63bdc4d24cc5aa63312edd216ebc74c0a7f74ed38783e27998a2c013a496e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a37E8.bat

Filesize
722B

MD5
30321d76406d40a2c266a777ee55cb92

SHA1
93e7b15bd6ddf2f66a4c50dffa468c2be0c5f298

SHA256
1b8eb3c5c0405cf130665308346801a89e5c7125a8223beb088311441e80ac05

SHA512
f49a28e1cff91d6087251f668d22696ca287c470ebca4497462a76ffd8f1d8f7433d6c3ee9e04c6a810d8c630aa08e23a8fc566bac9d31564de9250c7986c6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe.exe

Filesize
315KB

MD5
09ac2b6f268980a4d135fe651bbf3cbe

SHA1
eee57f93ff5ca7b28046f55d668e357c12e63d85

SHA256
4be96b9592273c3ab2ac051e088a68f13c0e8aa8217dd5e809763abd7db44618

SHA512
09683bdb47fb2fe77c1b99ce7b850001b8771c968f2ef8d0fb354a27111c8294a164ac7a6912176913e15a15073aa95594c0c0da69cc43c7e1306b088370b2e2

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
feb8473549216daa0adec2e3945a3db8

SHA1
a0366043f5537172b5cc605afe339c28dce37d16

SHA256
23ffb3cc8727b16073e7944e36eabbf7b087f6923c78e88ed92c08b13af48671

SHA512
090cbae5bd60f40cc983cd6abd52af8ac083705e80fd08e676c72feff826844785f4d2e76c2a40bd85df0097eac64d4bf9fe008108051c2218cccfb6abd50848

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini

Filesize
8B

MD5
8de83b88f7ab26b8a33a1eeb970a7bc8

SHA1
ad3208ec0bdfacd12ad7291d0259ef41b6bfc425

SHA256
499baf65b91c9fff00cab334a4d8ab59d253993f173da5c33ff01ea4afc217fe

SHA512
9272af088cc70ebeb388cefda678d35e649433d3a6c5715f3537e2832b3fead9568d58a026c36ab711fdef87597419e8be80a5d809530a933f72328c413a5d7e

Download Submit
memory/564-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/564-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-35-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-1234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-4801-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-5240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3416-20-0x000001D7675B0000-0x000001D767600000-memory.dmp

Filesize
320KB

Download
memory/3416-19-0x00007FF950993000-0x00007FF950995000-memory.dmp

Filesize
8KB

Download