396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c

Analysis

max time kernel
149s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
Size

52KB
MD5

eb60b9f77793c9ce464a5ee35dd12dfb
SHA1

81135ef3c56940ee4dd02229dc4bc111bf29b754
SHA256

396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c
SHA512

2204958727e04c5b882029e2ee1d4e43d2b874844590da879abd488291345746b5e49be2d2bf6f54cb8c8be265d23f8254ce1d36d1c431a078b025b869471252
SSDEEP

768:pX1dv16GVRu1yK9fMnJG2V9dHS85qgt6jpYU5ltbDrYiI0oPxWExI:pX1d93SHuJV9NP6jWWvr78Pxc

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2448	Logo1_.exe
2728	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe

Loads dropped DLL 5 IoCs

pid	Process
2036	cmd.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpenc.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
File created	C:\Windows\Logo1_.exe	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2036	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	29
PID 1148 wrote to memory of 2036	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	29
PID 1148 wrote to memory of 2036	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	29
PID 1148 wrote to memory of 2036	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	29
PID 1148 wrote to memory of 2448	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	30
PID 1148 wrote to memory of 2448	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	30
PID 1148 wrote to memory of 2448	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	30
PID 1148 wrote to memory of 2448	1148	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	30
PID 2448 wrote to memory of 2168	2448	Logo1_.exe	31
PID 2448 wrote to memory of 2168	2448	Logo1_.exe	31
PID 2448 wrote to memory of 2168	2448	Logo1_.exe	31
PID 2448 wrote to memory of 2168	2448	Logo1_.exe	31
PID 2168 wrote to memory of 2856	2168	net.exe	34
PID 2168 wrote to memory of 2856	2168	net.exe	34
PID 2168 wrote to memory of 2856	2168	net.exe	34
PID 2168 wrote to memory of 2856	2168	net.exe	34
PID 2036 wrote to memory of 2728	2036	cmd.exe	35
PID 2036 wrote to memory of 2728	2036	cmd.exe	35
PID 2036 wrote to memory of 2728	2036	cmd.exe	35
PID 2036 wrote to memory of 2728	2036	cmd.exe	35
PID 2728 wrote to memory of 2444	2728	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	36
PID 2728 wrote to memory of 2444	2728	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	36
PID 2728 wrote to memory of 2444	2728	396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe	36
PID 2448 wrote to memory of 1380	2448	Logo1_.exe	20
PID 2448 wrote to memory of 1380	2448	Logo1_.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
  "C:\Users\Admin\AppData\Local\Temp\396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF622.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe
      "C:\Users\Admin\AppData\Local\Temp\396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2728 -s 124
        5⤵
        Loads dropped DLL
        
        PID:2444
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
0e96df2b803787ad87d98fb164a286f5

SHA1
0790c9a340015c2e2ebbd5459c90b82cf6ae5f3a

SHA256
8951711f84a55417c6e4f31b004f415a75abe8b26696751f840fcc8e928b9a8e

SHA512
5fcc84cd18c7f9927e200ba37cc5ecf8d877736c3b14bc95d23aa734e9257db9b40a154cedcc56f1f3222f8153f93ca45ee2307315cfe3a14430a6c77d06501e

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
2d816096dcd7a9b38e9b445b75c019a1

SHA1
e3c192f07e460078a7b2db4aeb94d4c53700bd75

SHA256
43b6be2e758c7e161993e451ce005a00345b4f3ba8b3c069d55ce93ac7e19758

SHA512
6af3ed08658c195072f549af50b96cd05e8070bf468add1884caba811145e88e28ff016298ea52078d7d31bded223c12bf6ca294219610ba2a5036dd442d356c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aF622.bat

Filesize
722B

MD5
0317ed9afe2503b6b35c0151082c0fae

SHA1
922b8dd342d66d442519e4254f79bcdd0b175153

SHA256
bf915c25ba38050fb16bd96836298fee13a2692dc54a21dc6b7f377a82ac14bc

SHA512
2f1ecb3ab48d4b3c3711e2cdee7fdcab7d33bea7c4b9e84908b53e7c1e397f0e5a7f72588df1fee0cdbc8af00ba2ec270c4ce457a97457b49d28424336f20361

Download Submit
C:\Users\Admin\AppData\Local\Temp\396129632be308ab609bc07f85989ac7c5f7ae59a0a2a3376b9e9626ba77a57c.exe.exe

Filesize
23KB

MD5
3f9dbfee668294872ef01b90740b01d0

SHA1
99a4702b65485cd14736b1c2cdfb81b455dda01c

SHA256
40b32fea1fcadcb2db369475e2bba58b0b83f5c3bb647e2e63877726c35a9f86

SHA512
0113cec160d97ea0cce70860cc5b79b502d16191ee237a3abb84309499be193aa0127dbcb41fc05a90fa61484b061ec4332ad29a918db598e32fe832b74bd1e3

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
2b5bdf36eb0fef11ac07c198ab0874b3

SHA1
e723dc372a2fb0bc9bace6adb679ccd0d13116f8

SHA256
28d5cdb855181907549e049c00abfceb1edeaf73d56a15fafc28c3503cae0a2e

SHA512
fcdadc2227f91d188712c628e58be7c8081488623dd2287c715d7ddda66fc547a419f6e168858dc560dd89478a408d11413b49aeaed11162e1ae34a62ea1f28c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2172136094-3310281978-782691160-1000\_desktop.ini

Filesize
9B

MD5
79a2fb76ad00a8ac07f11b6a179f5297

SHA1
72b4f589fd7945d8c80b370d1d3a1f2467f3eb81

SHA256
2f723e98c3a3556269a4d81d4a27d6a0ab13a84c5ba737493c07354a2608684f

SHA512
3a21c2e60e8e035fb90d428e86bb927077d8354a16f1abc291ccba4a4d7fee4f51cf781fa9202e5602a88ca70a6ba264ac49762100be5f6e09a2ec930e098168

Download Submit
memory/1148-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1148-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1380-33-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/2448-35-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-42-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-94-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-100-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-934-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-1877-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-3022-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-3337-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download