c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
Size

2.3MB
MD5

79ae8800dc1059c4365073f4c15ed5eb
SHA1

a9ef66eda37414e731630c15b551cd251da13892
SHA256

c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a
SHA512

b95edc41bf5609cabf9a104240913004cc6801ad6cab3c22a97fcffa203454564d70740d25b2b8f9e3de5594674711c2b42846eaa4ebdd757d9849afe5cea5e2
SSDEEP

49152:J7iuAJld1NwfF0GSYbL+0Joz7ITd2fVy+dlyTTTulk1vOvUM:4uAJld1Nc/P6zud2fVy4lggk2vUM

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2660	Logo1_.exe
2564	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe

Loads dropped DLL 1 IoCs

pid	Process
2664	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
File created	C:\Windows\Logo1_.exe	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2564	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
2564	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe
2660	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2564	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2664	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	30
PID 2652 wrote to memory of 2664	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	30
PID 2652 wrote to memory of 2664	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	30
PID 2652 wrote to memory of 2664	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	30
PID 2652 wrote to memory of 2660	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	31
PID 2652 wrote to memory of 2660	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	31
PID 2652 wrote to memory of 2660	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	31
PID 2652 wrote to memory of 2660	2652	c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe	31
PID 2660 wrote to memory of 2820	2660	Logo1_.exe	33
PID 2660 wrote to memory of 2820	2660	Logo1_.exe	33
PID 2660 wrote to memory of 2820	2660	Logo1_.exe	33
PID 2660 wrote to memory of 2820	2660	Logo1_.exe	33
PID 2820 wrote to memory of 2676	2820	net.exe	35
PID 2820 wrote to memory of 2676	2820	net.exe	35
PID 2820 wrote to memory of 2676	2820	net.exe	35
PID 2820 wrote to memory of 2676	2820	net.exe	35
PID 2664 wrote to memory of 2564	2664	cmd.exe	36
PID 2664 wrote to memory of 2564	2664	cmd.exe	36
PID 2664 wrote to memory of 2564	2664	cmd.exe	36
PID 2664 wrote to memory of 2564	2664	cmd.exe	36
PID 2660 wrote to memory of 1212	2660	Logo1_.exe	21
PID 2660 wrote to memory of 1212	2660	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
  "C:\Users\Admin\AppData\Local\Temp\c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aFFA3.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe
      "C:\Users\Admin\AppData\Local\Temp\c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2564
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
02378bd465c0d57e5becd8dec3895848

SHA1
e3352edc68a15994b9a8ff5c4b7bfb81e1b475b4

SHA256
2ff92e38be5bf6f9d6c761e5770b081d94f0ff53a24060d81e155bd19ffc9cbe

SHA512
362ca40c0c5d68fbd8cf40511d08bba5de4e0acc1382429ef95711ab4fc7afced3500ffc686ab76daf7dd66716aba749e27ba014d91869f13ca6442c8d56a63b

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aFFA3.bat

Filesize
722B

MD5
5ac93773801d11498bacbcada0074e1d

SHA1
1d9da638f36988d32b045a94dea6315f4e47f803

SHA256
a92be8698e96acb86ecf381861b9738dac29965047569a4f50837a28d9d95dde

SHA512
c383e41ae6cc475ee389f7135c220c6ba4602554f4e78b9e796313dd7192d5c2e591697a94a0a27734bccbdeb1b074309afea7c8730d12f7d4b82648b17fa245

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3bdd8ddd75e10a6fc012eecb6e7bb46499d53e56e4380700279abd58a03144a.exe.exe

Filesize
2.3MB

MD5
d424f3972ca2b1f314a037e97d906128

SHA1
e4511513afd534c7caab637537ba36752c1b2120

SHA256
6faa3a2305217bb7b09b48635f885be4943182279b743ce694361753d49f7e42

SHA512
bfe697bc02beacbc16484d60cb1d0268f8ecd0a707a3b1554fdb535130e85d487ea64e5fe098204be7e9b4a11374066178e68d9c727d14a89eefd079ba4ffb1e

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c474b36ee670d0befb8b3442b383647e

SHA1
cbefd636854e54c8ba30014c14a41130bb08f136

SHA256
e0f5b3669e539794344317f8000194313e5428a839a76341491c5698dd4b40f6

SHA512
ef840ac2b62a7146a699dbcf8101b8619dba97b96ed8c04f0546861d95cb6fa9e2e6cc676e7340d657d9c82071b6ff31c56ba77f76e069a37066a880d3c0a44e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\_desktop.ini

Filesize
9B

MD5
e02899454c67c7d6d1af854fdcb53b67

SHA1
26fb213f7c299c2a4d8c4afd234ee0b751d7a30e

SHA256
0e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315

SHA512
e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa

Download Submit
memory/1212-31-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/2564-28-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2564-29-0x0000000000400000-0x000000000068D000-memory.dmp

Filesize
2.6MB

Download
memory/2652-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2652-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-712-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-1877-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-3337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2660-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download