ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe
Size

52KB
MD5

8e292fad26fb924c8449c326b876919d
SHA1

968348980f7ae2de50cf33988efa2ab640955179
SHA256

ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440
SHA512

5df10465ae21ba23c2d47cdd54102ef10cfc2b500001f3e593bc3eafcc43b7b8936fee19fa4d43b4d81bdac7ed0cbb89a95e85024910e67bcfe13d8cb7cb6c51
SSDEEP

768:p5GQ16GVRu1yK9fMnJG2V9dHS85qgt6jpYU5ltbDrYiI0oPxWExI:p593SHuJV9NP6jWWvr78Pxc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2304	Logo1_.exe
4828	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Crashpad\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	OpenWith.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe
2304	Logo1_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2580	OpenWith.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3636	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	84
PID 3740 wrote to memory of 3636	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	84
PID 3740 wrote to memory of 3636	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	84
PID 3740 wrote to memory of 2304	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	85
PID 3740 wrote to memory of 2304	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	85
PID 3740 wrote to memory of 2304	3740	ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe	85
PID 2304 wrote to memory of 1572	2304	Logo1_.exe	87
PID 2304 wrote to memory of 1572	2304	Logo1_.exe	87
PID 2304 wrote to memory of 1572	2304	Logo1_.exe	87
PID 1572 wrote to memory of 4792	1572	net.exe	89
PID 1572 wrote to memory of 4792	1572	net.exe	89
PID 1572 wrote to memory of 4792	1572	net.exe	89
PID 3636 wrote to memory of 4828	3636	cmd.exe	91
PID 3636 wrote to memory of 4828	3636	cmd.exe	91
PID 2304 wrote to memory of 3520	2304	Logo1_.exe	56
PID 2304 wrote to memory of 3520	2304	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3520
- C:\Users\Admin\AppData\Local\Temp\ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe
  "C:\Users\Admin\AppData\Local\Temp\ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAECE.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe
      "C:\Users\Admin\AppData\Local\Temp\ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe"
      4⤵
      Executes dropped EXE
      PID:4828
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
f0564620e97d5639fe2e5d4f3e4f25ad

SHA1
fb291e87960eff1d91cb35d4d1d3aa571d7a5e4f

SHA256
07394add7691aec2545473a3ecb3449751c174f66f6e683979ef39b1c941d185

SHA512
f90f74aac592750f0a18d109ed82557a36e0bc077105fb0ae22f257d017daa9497456b339b8bb1387843bae9f1a12082c2d561555e876a98d6339c9e67226d1a

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
62473a1ffa08ed3c698ccc01d8cea318

SHA1
11c46ec0c4f243f7d0253684a0a16bd8c86a0dfc

SHA256
77cbc5c19b26e0b293280c0c7698257bf53bf8950f5dccb6ea7a7c0b17e69154

SHA512
5a3296b1b26ec78536243259e7a2cd1c74dd71ac967bcd6df3674a22cacc61c1130f0377d7a670aba058aefb4d82ab0d856b3c2b2a751d3036723894c296223b

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
047ea637aad18e289a8d0455d4810c61

SHA1
5d17488350ec3bd53feb8838dbc75584e5e87494

SHA256
dfc2bf89b8ad3cca8cf22760ce4d5ab754d488ff43a8ceade0c053451df45110

SHA512
0544c524354bbaeb61825b119247bec9e6bcdb5035534e6b7ba1100ce1dcb7bb641ae8108692ef95bd4882b6c2a12e02e0993da940fce545af9bfd6cd2b4fe00

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aAECE.bat

Filesize
722B

MD5
dea20705560b3ab127a91d4da43e315d

SHA1
836bd8f6418526666bcca96692c093d1ed7b2d2c

SHA256
38cf2dc06a8315c74718de1c64855dbb318f84cb2758a8cba5de5af9b45f7c4a

SHA512
a787da356385401d83fae3577cb723402c9544d3955de1b176c697b0aa525b7629f476d9e0ddb17a8a4487b5f5932599983cbe57ee41680cc577b948b51ce65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab1be4da62098e3d427de141197804441f03cb74313a99e42b820b4ff7e4a440.exe.exe

Filesize
23KB

MD5
3f9dbfee668294872ef01b90740b01d0

SHA1
99a4702b65485cd14736b1c2cdfb81b455dda01c

SHA256
40b32fea1fcadcb2db369475e2bba58b0b83f5c3bb647e2e63877726c35a9f86

SHA512
0113cec160d97ea0cce70860cc5b79b502d16191ee237a3abb84309499be193aa0127dbcb41fc05a90fa61484b061ec4332ad29a918db598e32fe832b74bd1e3

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
a138bbeeec7d59fbd516ef0237d829c6

SHA1
e32be6ab403d2f1af197ec5543e0142320078a2a

SHA256
046edb4bab763c08349077cc670cdfe5eaf12056913bdd6a0beb4acfe7e93e8f

SHA512
458ff81f98d79b44edf27d2b0b981d33e9678270dd206ac59ed0333a0f2535dd7062b75e56dbe5976fc80d67c89460278eec982b025743d9465fe5360119879c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1176886754-713327781-2233697964-1000\_desktop.ini

Filesize
9B

MD5
1368e4d784ef82633de86fa6bc6e37f9

SHA1
77c7384e886b27647bb4f2fd364e7947e7b6abc6

SHA256
57507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772

SHA512
3cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b

Download Submit
memory/2304-26-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-36-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-1232-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-4799-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-5244-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3740-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3740-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download