gozi | 866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easfawefawfas.exe
Size

12KB
MD5

2813b6e3ed4bd6b14c53e3dffcdff21d
SHA1

5ac7c7a3dadde70f94810c608a2eb275f14b7bde
SHA256

866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
SHA512

ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
SSDEEP

192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Score

10^/10

gozi banker isfb spyware stealer trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exeeasfawefawfas.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	easfawefawfas.exe

Executes dropped EXE 1 IoCs

Processes:

p1ydrhwy.exe

pid process

3956 p1ydrhwy.exe
Loads dropped DLL 1 IoCs

Processes:

easfawefawfas.exe

pid process

4376 easfawefawfas.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

41 discord.com
14 raw.githubusercontent.com
15 raw.githubusercontent.com
24 discord.com
25 discord.com
28 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

664 schtasks.exe

pid	process
3956	p1ydrhwy.exe

flow	ioc
41	discord.com
14	raw.githubusercontent.com
15	raw.githubusercontent.com
24	discord.com
25	discord.com
28	discord.com

pid	process
664	schtasks.exe

Modifies registry class 7 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\consoleitaly1826.vbs"	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

easfawefawfas.exep1ydrhwy.exe

pid	process
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
3956	p1ydrhwy.exe
3956	p1ydrhwy.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe
4376	easfawefawfas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

easfawefawfas.exep1ydrhwy.exe

description pid process

Token: SeDebugPrivilege 4376 easfawefawfas.exe
Token: SeDebugPrivilege 3956 p1ydrhwy.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

easfawefawfas.exe

pid process

4376 easfawefawfas.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3532 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4376	easfawefawfas.exe
Token: SeDebugPrivilege	3956	p1ydrhwy.exe

pid	process
3532	Explorer.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

easfawefawfas.execmd.exeComputerDefaults.exewscript.execmd.exep1ydrhwy.exe

description	pid	process	target process
PID 4376 wrote to memory of 4912	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 4912	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 4912	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 4452	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 4452	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 4452	4376	easfawefawfas.exe	reg.exe
PID 4376 wrote to memory of 2456	4376	easfawefawfas.exe	cmd.exe
PID 4376 wrote to memory of 2456	4376	easfawefawfas.exe	cmd.exe
PID 4376 wrote to memory of 2456	4376	easfawefawfas.exe	cmd.exe
PID 2456 wrote to memory of 4600	2456	cmd.exe	ComputerDefaults.exe
PID 2456 wrote to memory of 4600	2456	cmd.exe	ComputerDefaults.exe
PID 2456 wrote to memory of 4600	2456	cmd.exe	ComputerDefaults.exe
PID 4600 wrote to memory of 1844	4600	ComputerDefaults.exe	wscript.exe
PID 4600 wrote to memory of 1844	4600	ComputerDefaults.exe	wscript.exe
PID 4600 wrote to memory of 1844	4600	ComputerDefaults.exe	wscript.exe
PID 1844 wrote to memory of 3708	1844	wscript.exe	cmd.exe
PID 1844 wrote to memory of 3708	1844	wscript.exe	cmd.exe
PID 1844 wrote to memory of 3708	1844	wscript.exe	cmd.exe
PID 4376 wrote to memory of 4996	4376	easfawefawfas.exe	cmd.exe
PID 4376 wrote to memory of 4996	4376	easfawefawfas.exe	cmd.exe
PID 4376 wrote to memory of 4996	4376	easfawefawfas.exe	cmd.exe
PID 4996 wrote to memory of 664	4996	cmd.exe	schtasks.exe
PID 4996 wrote to memory of 664	4996	cmd.exe	schtasks.exe
PID 4996 wrote to memory of 664	4996	cmd.exe	schtasks.exe
PID 4376 wrote to memory of 3956	4376	easfawefawfas.exe	p1ydrhwy.exe
PID 4376 wrote to memory of 3956	4376	easfawefawfas.exe	p1ydrhwy.exe
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE
PID 3956 wrote to memory of 3532	3956	p1ydrhwy.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3532

C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f
3⤵
- Modifies registry class
PID:4912

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
3⤵
- Modifies registry class
PID:4452

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C computerdefaults.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\ComputerDefaults.exe
computerdefaults.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\wscript.exe
"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs
5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
6⤵
PID:3708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
3⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
4⤵
- Creates scheduled task(s)
PID:664

C:\Users\Admin\AppData\Local\Temp\p1ydrhwy.exe
"C:\Users\Admin\AppData\Local\Temp\p1ydrhwy.exe" explorer.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\110486d68f0d4ed2b54011b4a917fe8a

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c62ed760a26a437791008627472c07c3

Filesize
8KB

MD5
11eccda94b88f3db84b376ce873afbf5

SHA1
ece6f4726b7bfc4bd1fadd6388474b88221de243

SHA256
47783b4f25676156524bf7cd94dc289ebd4983f27430ca6680c9374b7c4e34e4

SHA512
4001417ec7f65fa8b862745c2d35bb74c6465f46307e68f76f3f238c9a317378bd5821356f6e82146d5378ef6c30481b33c903396126b84fce1e5ced4608dbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c94af81ff8844cfaa412e9025397145f

Filesize
130KB

MD5
37e566b4ece84d605e9ce530f57395cf

SHA1
0289f8fa9f891ed9104da4bdadf97c7ee2f33bf3

SHA256
9127743a82356360e40a9a2c32242fdf2dbe8eee246054f6699146330eea47f2

SHA512
275b31bc8a205f2fd0154b65439800e3838206271ede18504be2226f2d289d63a513f1703f9c5700bb41f1167f545d2e261d94e25ba6382fac951b4c876b7b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs

Filesize
171B

MD5
a34267102c21aff46aecc85598924544

SHA1
77268af47c6a4b9c6be7f7487b2c9b233d49d435

SHA256
eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

SHA512
5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\p1ydrhwy.exe

Filesize
124KB

MD5
e898826598a138f86f2aa80c0830707a

SHA1
1e912a5671f7786cc077f83146a0484e5a78729c

SHA256
df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

SHA512
6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aF1UAEIDIV\nzxw1g49.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Filesize
48KB

MD5
19ef756826ae9e0cfc886b8b41645c9f

SHA1
56c910d7b8aef64ce07143b7281bfc6fef4313c4

SHA256
61d2143cd06528896f2af589bdbdd5dc8803dc7a9905276c5ac38a3f81bbba52

SHA512
d8b96dc0ac08b7cacb3c3309733a5b6f9e3380862fab33b8a93747e07477665a6bc5e3189a32f8df3623f560cdf6c3a06d2ee642e7b5c35dd8421686d5f5e8b7

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aQ618LA6HD\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aQ618LA6HD\LOG

Filesize
332B

MD5
c2258bd137d67e3db1fea34dab8a9b8b

SHA1
bb8c726af562d8f7246b9c9ef3a2499f447c746d

SHA256
3b1e0962f7428a69a57aac3b6a4df37c1c0554b183c343df39d144f1a6c60407

SHA512
d6ae75dac07dbcf207553967ca3e0bcbba3213f0e61ddd7b2b6df8ff054df66ee1108f162de292ae88b0b76dcd2645ff88cfc4de77a781a5657fbbc74e00cdce

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aQ618LA6HD\LOG.old

Filesize
289B

MD5
944bf0d766891fdc9833e35fa69a2699

SHA1
eb1e1cb921f599e13f2fc2a991e07102b8c546b6

SHA256
9cf52d4ee3d8fa478be19a584e0418831525276ff326c27b579ace76ff59c956

SHA512
a111c2ca5193c421e7383f8287e6e422a3f2f6f34fe5d819a9fa6f0e858537c9930cfd8fff11778d6cf5c1132c4ed71c8b79c506a2bc717a4eaa965be3e34d71

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aQ618LA6HD\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aYLQ8RJIRT\LOG

Filesize
334B

MD5
958b0aecccf419ff248c80eedfacbb39

SHA1
8b5c07bfebd9e901c636d1db21be27f060756a0e

SHA256
b1866f1e39337f4b7ee5740cbb1e15b3065d0ff3e2db264be6e44fac6409b2a9

SHA512
dc2f1bdaaf37656d546687fbdbd311f61c7a11e4d9616427b5e513c36b50c6c54bfc9b4bcbc68af2e36eec0293dec864b8661d5a3f491b00ba4733e7701d5f60

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aYLQ8RJIRT\LOG.old

Filesize
293B

MD5
01ec7fa475f0d730243cb82750ae2b52

SHA1
5fc4d0bb567975b413d0b4a3d5dbfe2fd3f9c476

SHA256
c0397381295f993208db232e4888940b7c90a3bef9d16d95301e3f63676c1fea

SHA512
66de9eaf62af13a6da986fba3cf8d7cd47e36727f7c33717b72f1838ab469adb9fe85948f0fe1afc7ae333ed9ed08ea8bc0b177e898bc34981a0a6d6018c0bf9

Download Submit
memory/3532-33-0x0000000001270000-0x0000000001278000-memory.dmp

Filesize
32KB

Download
memory/3532-28-0x0000000001270000-0x0000000001278000-memory.dmp

Filesize
32KB

Download
memory/3532-29-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/3532-30-0x0000000001270000-0x0000000001278000-memory.dmp

Filesize
32KB

Download
memory/3532-32-0x0000000001270000-0x0000000001278000-memory.dmp

Filesize
32KB

Download
memory/4376-18-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/4376-173-0x00000000067F0000-0x000000000685A000-memory.dmp

Filesize
424KB

Download
memory/4376-12-0x0000000011A00000-0x00000000126A2000-memory.dmp

Filesize
12.6MB

Download
memory/4376-11-0x0000000074ECE000-0x0000000074ECF000-memory.dmp

Filesize
4KB

Download
memory/4376-10-0x000000000AC80000-0x000000000B880000-memory.dmp

Filesize
12.0MB

Download
memory/4376-6-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/4376-5-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/4376-4-0x0000000004FD0000-0x0000000005062000-memory.dmp

Filesize
584KB

Download
memory/4376-168-0x0000000006720000-0x00000000067D2000-memory.dmp

Filesize
712KB

Download
memory/4376-169-0x0000000000F90000-0x0000000000FB2000-memory.dmp

Filesize
136KB

Download
memory/4376-170-0x0000000009320000-0x0000000009396000-memory.dmp

Filesize
472KB

Download
memory/4376-171-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/4376-172-0x00000000093A0000-0x00000000093F0000-memory.dmp

Filesize
320KB

Download
memory/4376-0-0x0000000074ECE000-0x0000000074ECF000-memory.dmp

Filesize
4KB

Download
memory/4376-174-0x00000000093F0000-0x0000000009744000-memory.dmp

Filesize
3.3MB

Download
memory/4376-175-0x0000000009750000-0x000000000979C000-memory.dmp

Filesize
304KB

Download
memory/4376-179-0x000000000A440000-0x000000000A47C000-memory.dmp

Filesize
240KB

Download
memory/4376-180-0x00000000097F0000-0x0000000009811000-memory.dmp

Filesize
132KB

Download
memory/4376-3-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/4376-2-0x0000000004EE0000-0x0000000004EFA000-memory.dmp

Filesize
104KB

Download
memory/4376-195-0x000000000A680000-0x000000000A68A000-memory.dmp

Filesize
40KB

Download
memory/4376-1-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/4376-199-0x000000000A920000-0x000000000A986000-memory.dmp

Filesize
408KB

Download
memory/4376-200-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/4376-201-0x000000000AC20000-0x000000000AC2A000-memory.dmp

Filesize
40KB

Download
memory/4376-202-0x000000000AC70000-0x000000000AC7C000-memory.dmp

Filesize
48KB

Download
memory/4376-203-0x0000000011260000-0x0000000011268000-memory.dmp

Filesize
32KB

Download