d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
Size 630KB
Sample260831-e1gjhavcka
SHA256 d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4
MD5 5c8e4a7f3a7e91328e94388143aff82d
SHA1 772d819e74c02193e05f0b7e6e9fd4246d636403
SHA512 ea7c1cfea1bf47cb847c96cb8b4c141dc95d344ca2c32cdb7da86e1b96026b4138e317d500e7815c94b5467115e34754172d092dea2e52767dee85989e4a437d
SSDEEP 12288:ppJcnvX4YaLhPoXrv4DSZ10cpF0P6dDel06C4G5K+BYRuxg6bVsSEcz5sPc:ppJckYwDSZ1HS1tG5PdXEe5Oc
TLSH
T19ED45B1074B2C0F1E1A142711EF9EBE154BDBD316B204AEB77907E765A307C26A31A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4060	Logo1_.exe
5128	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
File created	C:\Windows\Logo1_.exe	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe
4060	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1092	996	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe	89
PID 996 wrote to memory of 4060	996	d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe	90
PID 4060 wrote to memory of 5192	4060	Logo1_.exe	91
PID 5192 wrote to memory of 788	5192	net.exe	93
PID 1092 wrote to memory of 5128	1092	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
"C:\Users\Admin\AppData\Local\Temp\d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe
    "C:\Users\Admin\AppData\Local\Temp\d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe"
    3⤵
    - Executes dropped EXE
    PID:5128
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 b7b1db2bd627d68013fbadf44edf16707e9356568be3c3d4000880f9bc7f1e3d
MD5 8245cef3509ed0d7e6d16ce9ac944b69
SHA1 fecdc316c3d5b7f153be8c531194899dd2013f1b
SHA512 7268963c5ee72cbc0cabcadf7e6e910e5a2c9c190c570c48940544c206b34fd20bbfe1e0595157c4cdae0f1bebe5e40dd5c69d32f2a8cf50d3eb0566a137296d
SSDEEP 3072:zkF3pnhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:oFphG7/fYfLvzB+QFyn
TLSH
T149C38D1375D084A1E5B10D3008E5EA719D7FF9620F40AEAB378466BD0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4637.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
Size 722B
SHA256 5947fb53cbf3bb6606cb0e55230d0161c684f4ca53b37488cf6f5fb91202d41f
MD5 5a537afb531deaf383332d5531b47f71
SHA1 816def3ca7ef584cd58ebf9b6c5ff2da5a953805
SHA512 aa1201efea7b6c811cd07fdb9631f5bc6000786b9a00d8871def6ad2422bfdc344d59b1b4dbb3092bb0f5c04c2605fa67b4e35ba20ee5863e98c60c6a3b37d26
TLSH
T1170152805BD7CF3F4699511F4553F6AB81EE28F93F8232678B2493A80191669F0D119A
MD5 SHA1 SHA512 TLSH

Submit Download

d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d5448069fb2daebdddc91c12c0086982cc660368ff5f20303e85cadb9b9f7bd4.exe.exe
Size 603KB
SHA256 31786f9dccaf9f6f7105f59914fdc6d6631288afea816420980c446ca3740a17
MD5 c77d50d2966b80464fabc9f7f5f26196
SHA1 24b2d064b700d55f4edbf124fd393dac5ee18718
SHA512 840a644bde73ddfe471fa0ebd05381fd7eb4b51848ec6624f700886913743089a83630ad781d541fed8ae5e010e1ac4b0a600be975302574840eb786fe7aaccc
SSDEEP 12288:McnvX4YaLhPoXrv4DSZ10cpF0P6dDel06C4G5K+BYRuxg6bVsSEcz5sPc:MckYwDSZ1HS1tG5PdXEe5Oc
TLSH
T101D45A1074B2C0F1E1A142711EF9EBE154BDBD316B204AEB77907E765A307C26A31A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 9a67969315d53a2d52f034fc3811adf1375c6d0200d6c7e02efb2d23511c942c
MD5 5cb3b8e6c058ec9fbad2548f8a617f37
SHA1 a4611c2fb667416c9aa3afcce11d7038c1917d1a
SHA512 7ef859c71ab9d136cdd685ba04ae0ff47c4221951f97e2ae536cc87ae79e21e434e11d74d7797c32b146add2420a440b26e577506ae9e42c02808d8ee6029830
SSDEEP 384:MwCvU01Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:B5016GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T1AFC2E1F01ADA97A2C44417F60CEB4B2688F76161DFCD3EDF2F781D460CE0A0885A960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/996-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/996-15-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-29-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-35-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-39-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-161-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-1246-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-22-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-5043-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-10-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4060-5516-0x0000000000400000-0x0000000000435000-memory.dmp

Download