a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe
Size 2.6MB
Sample260922-jjhsfsbb33
SHA256 a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41
MD5 c9a4aa8d9ccdd31d36420049bbca58ee
SHA1 b43d834b72561d017e1181598510d0c57fb95f7a
SHA512 4c9983102d431583ced1b7476ff18ff093404a66802df0048c8576e16fbdc9d320ce80af9181987f574f4a147e5fd468da469fa7fe7cd432ac9e831e33ae21d6
SSDEEP 49152:97LJppoydf9KhttwEPokg4PoP4gadGBBt9WQ1q:hJppJxstBPokdg+Kr9W
TLSH
T1ACC5D01162C8903AF0765E374D7BE681A53DB9212E21DC1B3BEC174D5E79A40BE3632B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4620	Logo1_.exe
4968	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe
4620	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5148	5108	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe	89
PID 5108 wrote to memory of 4620	5108	a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe	90
PID 4620 wrote to memory of 4072	4620	Logo1_.exe	91
PID 4072 wrote to memory of 2904	4072	net.exe	94
PID 5148 wrote to memory of 4968	5148	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe
"C:\Users\Admin\AppData\Local\Temp\a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a769.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Users\Admin\AppData\Local\Temp\a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe
    "C:\Users\Admin\AppData\Local\Temp\a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe"
    3⤵
    - Executes dropped EXE
    PID:4968
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 adf90f86dce9411a889e8912fd5a701b3331db759c74b8c7d171788f18887696
MD5 31ead41f831865054b87b879886c884d
SHA1 f708d5c637c8a2c9ef075ccbbb5cc1019d0e23b8
SHA512 71d3a1a552e2852ebe24ba1fe58d7523e35289550d7ba1c17654b15bb818bb4d8b6ef75952c1cfceef2ad6bd180fdd7d403b5ca980c4b6c5bcb82901285c9447
SSDEEP 3072:6ftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:6VfjmN2G7/fYfLvzB+QFyn
TLSH
T1D5C37C1371D08861E5B20C3449E1EA619E3FFD620B409EA737C467BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a769.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a769.bat
Size 721B
SHA256 511319b79da1caef6c6cc089d1537e6e92916693eb39512b213c1f1fd5fd5fd1
MD5 a61ef40f9398197f7b88b220b5baa242
SHA1 28de229467e82357ae44110061efb41dc97b7533
SHA512 5279f7f3e1d3651e9fcec4173965ae6354d1279b6a8c3ed6405a6a5e38a0511a019c61e5e5bc852c4e1ee2d1898d40fd22e78cc71bcc6c87a48aa0e67b3eb106
TLSH
T1D101F71B8A47D27F5CE641AB9A75919F80A309E8BD6637042736C98701817CC52FBFDC
MD5 SHA1 SHA512 TLSH

Submit Download

a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\a3cd75a47b98facf3320f451151abd49450cfdeec61df02f360f69243d1bfe41.exe.exe
Size 2.6MB
SHA256 11fc34f234d2effe88c1e920b1dca1f429f703f6b825014a6c6d709e01ef73dc
MD5 50bd390ac317e084f688f050124a9a59
SHA1 3fb5c9e902bbd5cbd5a221a7a22534b3facf6d98
SHA512 e4473de3d47ac7ae8d8770aaeaa1b4427cb5b1b376423a524809ddd01c9f3ad776d414233621f3c02c44317ad4369ef786457879f2f8a898c8c8c38fdc4ecc28
SSDEEP 49152:MJppoydf9KhttwEPokg4PoP4gadGBBt9WQ1q:MJppJxstBPokdg+Kr9W
TLSH
T1B9C5D01162C8903AF0765E374D7BE681A53DB9212E21DC1B3BEC174D5E79A40BE3632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 8c17a6352be45db89b3a3318a6cb45aec1c999af136a78aa784926c7c685dc94
MD5 9a5aab29544a628be3ea4a99efc55160
SHA1 1fe2bb5734ac4987589c9fd021db5dd2efc63769
SHA512 8583ecfcc8a3871fcec7107db1a0eb22dba7ea71ee0cf832c0dedb4984343e0899c904213a397b401d53ce076cc84ab6e01ead499253b5f8e62d5ef2d2c6a728
SSDEEP 768:B1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:XfgLdQAQfcfymN
TLSH
T121C2D07A26CC1675E8298D7CDFD65301833D0F7B499F54752AB27B7A2360A28610FA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1704430598-3087477806-3297458608-1000\_desktop.ini
Size 9B
SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
MD5 d9d782241ad413bd7830b21a7a78a87b
SHA1 d30216d58ec51737dc3b6f9a7a11a8406cf8c114
SHA512 601ae630e8408dc0467dbd1b03a2a1d7488c4e7afcaeec324019ea4d587c05f38d929a8dc05e2ddde3692b51a2de36d73a05067aa81eab5c25b5cc50de283857
MD5 SHA1 SHA512

Submit Download

memory/4620-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-74-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-5041-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4620-5514-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5108-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download