Analysis

  • max time kernel
    184s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 01:37

General

  • Target
    Setup MixHead v4.0.3.exe
  • Size 37.7MB
  • Sample240613-b18ffataqp
  • SHA256 e8c36d4c8b2974d7f42a0c9bdeb3213bb459f090addfe7b220384bd702ae8c8d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup MixHead v4.0.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup MixHead v4.0.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\is-6RPPF.tmp\Setup MixHead v4.0.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6RPPF.tmp\Setup MixHead v4.0.3.tmp" /SL5="$D0060,39143304,121344,C:\Users\Admin\AppData\Local\Temp\Setup MixHead v4.0.3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:884
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3840,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
    1⤵
      PID:3972

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          is-12TCO.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-12TCO.tmp
          • Size 339KB
          • SHA256 36ee83bf537fd9360730528abfd0c7c1c4a330e0f30ee76e09ed3efc9c47106e
          • MD5 SHA1 SHA512 SSDEEP

          is-1FIHA.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-1FIHA.tmp
          • Size 85KB
          • SHA256 40383f6f753dd6b5351027bdd778cac56e5575afd94f87507b0baffcd76a4c57
          • MD5 SHA1 SHA512 SSDEEP

          is-2JBP0.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-2JBP0.tmp
          • Size 26KB
          • SHA256 fe50c426c624d05cd847e5a10701c76f694e355c1c0a9c24fe6ba06474bae83f
          • MD5 SHA1 SHA512 SSDEEP

          is-3A45M.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-3A45M.tmp
          • Size 37KB
          • SHA256 7d02b157cbc0a50d673e72bd44436dd936984c74e1a4f9805bb2ec04d6f8c86f
          • MD5 SHA1 SHA512 SSDEEP

          is-4JRLO.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-4JRLO.tmp
          • Size 82KB
          • SHA256 7f700525d9714fd248b38710d50a39b8063bc14d8027c40a6cfd1f134588a3aa
          • MD5 SHA1 SHA512 SSDEEP

          is-4M96M.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-4M96M.tmp
          • Size 18KB
          • SHA256 c5181a0e0178d7f603b7f66167607202d114d9421202fd3b581afacf1aa38a02
          • MD5 SHA1 SHA512 SSDEEP

          is-4MFJ6.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-4MFJ6.tmp
          • Size 110KB
          • SHA256 931a0a2b5018bc211510d67b43b3d507fb29e693a83aee76622aa167e798440a
          • MD5 SHA1 SHA512 SSDEEP

          is-6F6SM.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-6F6SM.tmp
          • Size 85KB
          • SHA256 b5520a838c78f688708c68e25a611c5750249abb7f27f768822873e57f3a3836
          • MD5 SHA1 SHA512 SSDEEP

          is-7GPGC.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-7GPGC.tmp
          • Size 12KB
          • SHA256 5881c83248b5b7144dc51fdf1dfffd022c01176bd8bcd0ab9b1c17ba480e7da4
          • MD5 SHA1 SHA512 SSDEEP

          is-80E6K.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-80E6K.tmp
          • Size 3KB
          • SHA256 a05f22d446c82e3406816e445a9dc025404721256fd4a757e3a9d2fc047cda2c
          • MD5 SHA1 SHA512

          is-88K3U.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-88K3U.tmp
          • Size 21KB
          • SHA256 744530870452ac7cea119f99563f9378c59e61161e06e00524f4d48e54920635
          • MD5 SHA1 SHA512 SSDEEP

          is-9V3GV.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-9V3GV.tmp
          • Size 83KB
          • SHA256 039eb0d7566d282bc6874e9e917320eb466f07ffb30eeb0a80988dc6610d601b
          • MD5 SHA1 SHA512 SSDEEP

          is-A92EO.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-A92EO.tmp
          • Size 3KB
          • SHA256 3860fcab4d797f3cfc7a2b6113ffc0047c0105ca67fff5701dc22b0a45b61f42
          • MD5 SHA1 SHA512

          is-APV6D.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-APV6D.tmp
          • Size 84KB
          • SHA256 64afb1d1d2aa82193fc1e6420af754c0a823bcf4c853b1895dd4e0df2aa1743e
          • MD5 SHA1 SHA512 SSDEEP

          is-B1VTM.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-B1VTM.tmp
          • Size 12KB
          • SHA256 9c37bda06e51cb48aae4be59ecd3eb46276567c9c32060029e12c1e3f67ea466
          • MD5 SHA1 SHA512 SSDEEP

          is-B4FPS.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-B4FPS.tmp
          • Size 32KB
          • SHA256 e040941e563e29f41d5606781b51a03502eb7399ace044e8f436c8da2335acbd
          • MD5 SHA1 SHA512 SSDEEP

          is-BAUOK.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-BAUOK.tmp
          • Size 85KB
          • SHA256 7fd7aec2321934a6309c33d4758f32df33d54b08fdf188d6d4a8bdb12f9b6377
          • MD5 SHA1 SHA512 SSDEEP

          is-CN1FO.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-CN1FO.tmp
          • Size 25KB
          • SHA256 ae2598b1ea88c8550dce5de216f8536a195a162404778091623bafda4e130611
          • MD5 SHA1 SHA512 SSDEEP

          is-DT9T0.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-DT9T0.tmp
          • Size 27KB
          • SHA256 374f542d780512613ec9a971deafe1e87f58431e2f210419f64b86ac9c66d5c1
          • MD5 SHA1 SHA512 SSDEEP

          is-EH4B1.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-EH4B1.tmp
          • Size 4KB
          • SHA256 28a92f043855ea0a3a5645a61d527f9b5d1db95ca8f5830bcb1cb6fc48ae5305
          • MD5 SHA1 SHA512 SSDEEP

          is-EUFR8.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-EUFR8.tmp
          • Size 83KB
          • SHA256 c5306f2d0c9d557e6a2ecac9da21d1e9be05b085a685300cb54bd46eb6fdcca5
          • MD5 SHA1 SHA512 SSDEEP

          is-F4KJD.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-F4KJD.tmp
          • Size 83KB
          • SHA256 889e2aab2582dca7a50fed86badf88565195100d458993bf6f8ebe780aa5091e
          • MD5 SHA1 SHA512 SSDEEP

          is-GH14J.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-GH14J.tmp
          • Size 20KB
          • SHA256 836f7860c59e2f4d4d54e16bc082f95f3942f2890df916af5d39bf679423fe94
          • MD5 SHA1 SHA512 SSDEEP

          is-H20DQ.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-H20DQ.tmp
          • Size 1KB
          • SHA256 93691b75c45f41b5f1354dd2af457de8513216cd33b1f952774c0c57bd9e884c
          • MD5 SHA1 SHA512

          is-HACHB.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-HACHB.tmp
          • Size 248KB
          • SHA256 9b66fc09ed4d86377678e66dfe6684935d41d244aca96f372c2764f1f508bf67
          • MD5 SHA1 SHA512 SSDEEP

          is-JHUI5.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-JHUI5.tmp
          • Size 15KB
          • SHA256 beb7c201d55987d0b293f34b9e0e1a996d05513ea03e5a19816d953ffdd4f038
          • MD5 SHA1 SHA512 SSDEEP

          is-K7MPI.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-K7MPI.tmp
          • Size 11KB
          • SHA256 c217dd153620f12644a4313b7cd1a5cb3070d961a2f4a0db4cfcca560a2e6f76
          • MD5 SHA1 SHA512 SSDEEP

          is-MJ4D1.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-MJ4D1.tmp
          • Size 83KB
          • SHA256 71ac09a43e3946fd2c87fdb04bfbea8595f0e254957fe9d7d3734658b6c16dba
          • MD5 SHA1 SHA512 SSDEEP

          is-N80CA.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-N80CA.tmp
          • Size 83KB
          • SHA256 490011dfd91b22f53344a71f1b27a5c0f581607325bb2cf810838df640f7a05d
          • MD5 SHA1 SHA512 SSDEEP

          is-NTT27.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-NTT27.tmp
          • Size 139KB
          • SHA256 aef97e37ddfdefca4f2d57eaf27de3d519a6d14c1ec2dc3e23796249f7726847
          • MD5 SHA1 SHA512 SSDEEP

          is-OM02J.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-OM02J.tmp
          • Size 83KB
          • SHA256 aef3c22543488a8d889261d20d4b71928cfe9981823cee62e97e2612623a4f44
          • MD5 SHA1 SHA512 SSDEEP

          is-OPOGL.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-OPOGL.tmp
          • Size 6KB
          • SHA256 56522ce05699f48b2ca786813e8ef462c1fe74f8f2c4c54fb045ca1ac857b29b
          • MD5 SHA1 SHA512 SSDEEP

          is-PB1DM.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-PB1DM.tmp
          • Size 6KB
          • SHA256 0315b9557c85edbe3cb274e6369f695f3289eaf7831af9bfe8a613c808d6de71
          • MD5 SHA1 SHA512 SSDEEP

          is-POGIH.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-POGIH.tmp
          • Size 1KB
          • SHA256 3d4baa95810091914542c1c22d1e8706d55354498e79b471de150b54459032de
          • MD5 SHA1 SHA512

          is-Q8I3G.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-Q8I3G.tmp
          • Size 99KB
          • SHA256 67bf713e48bf0cb026ba62ad198ae625bea3c9032d25c757549bb1ca6e7577fa
          • MD5 SHA1 SHA512 SSDEEP

          is-R8EJI.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-R8EJI.tmp
          • Size 84KB
          • SHA256 6fce9603512ed3ef20789e7e0d99a0b5c4856c0a0a0856d9816d0be7c9a7bec4
          • MD5 SHA1 SHA512 SSDEEP

          is-RKTH5.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-RKTH5.tmp
          • Size 152KB
          • SHA256 4d88a8d63c53e6e972705fa7cc6af6d4608dd0038e36e3d873b936a0380af0d0
          • MD5 SHA1 SHA512 SSDEEP

          is-S7FQM.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-S7FQM.tmp
          • Size 83KB
          • SHA256 435dbcbfdee4e14c1f1dd01c7fa9eb74e81cf0b1a38f0f61131912230c7c0ace
          • MD5 SHA1 SHA512 SSDEEP

          is-T92ST.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-T92ST.tmp
          • Size 3KB
          • SHA256 fe1711fc0cc3059e4f6c21d6333f14429b7872594b5c2f7f32c7b6ef17984de4
          • MD5 SHA1 SHA512

          is-TCLQU.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-TCLQU.tmp
          • Size 24KB
          • SHA256 9c4748df07b8185f7cb7642dd8476aaa5e62f126ca92c88de74bedec0dc6d0a7
          • MD5 SHA1 SHA512 SSDEEP

          is-VBBGM.tmp

          • Path C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Make Believe Studios\MBMixHead.aaxplugin\Contents\Resources\is-VBBGM.tmp
          • Size 193KB
          • SHA256 aa77c81e6639b585a52b089cb51b95e3dbf9c72ecfae09566aba852a9bc0691a
          • MD5 SHA1 SHA512 SSDEEP

          Setup MixHead v4.0.3.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-6RPPF.tmp\Setup MixHead v4.0.3.tmp
          • Size 1.1MB
          • SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
          • MD5 SHA1 SHA512 SSDEEP

          ISSKINU.DLL

          • Path C:\Users\Admin\AppData\Local\Temp\is-GSROD.tmp\ISSKINU.DLL
          • Size 357KB
          • SHA256 e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
          • MD5 SHA1 SHA512 SSDEEP

          R2RINNO.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-GSROD.tmp\R2RINNO.dll
          • Size 4KB
          • SHA256 48a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
          • MD5 SHA1 SHA512

          SKIN.CJSTYLES

          • Path C:\Users\Admin\AppData\Local\Temp\is-GSROD.tmp\SKIN.CJSTYLES
          • Size 813KB
          • SHA256 4731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
          • MD5 SHA1 SHA512 SSDEEP

          memory/884-40-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-76-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-62-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-60-0x00000000766C0000-0x00000000766E5000-memory.dmp

          memory/884-58-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-56-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-55-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-54-0x0000000075590000-0x0000000075604000-memory.dmp

          memory/884-53-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-79-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-74-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-70-0x00000000758D0000-0x00000000759AC000-memory.dmp

          memory/884-69-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-66-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-50-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-59-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-49-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-48-0x0000000075590000-0x0000000075604000-memory.dmp

          memory/884-57-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-46-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-45-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-52-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-51-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-44-0x00000000765D0000-0x00000000766B3000-memory.dmp

          memory/884-160-0x0000000000400000-0x000000000052E000-memory.dmp

          memory/884-64-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-65-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-67-0x0000000075590000-0x0000000075604000-memory.dmp

          memory/884-68-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-71-0x00000000765D0000-0x00000000766B3000-memory.dmp

          memory/884-73-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-72-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-75-0x0000000075590000-0x0000000075604000-memory.dmp

          memory/884-63-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-77-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-78-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-80-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-61-0x0000000075590000-0x0000000075604000-memory.dmp

          memory/884-47-0x0000000075610000-0x0000000075820000-memory.dmp

          memory/884-43-0x00000000758D0000-0x00000000759AC000-memory.dmp

          memory/884-42-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-41-0x0000000074740000-0x0000000074862000-memory.dmp

          memory/884-1241-0x0000000000400000-0x000000000052E000-memory.dmp

          memory/884-38-0x0000000076710000-0x0000000076CC3000-memory.dmp

          memory/884-39-0x0000000075D30000-0x0000000075DDF000-memory.dmp

          memory/884-37-0x00000000765D0000-0x00000000766B3000-memory.dmp

          memory/884-30-0x00000000766C0000-0x00000000766E5000-memory.dmp

          memory/884-32-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-28-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-31-0x0000000074910000-0x0000000074940000-memory.dmp

          memory/884-33-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-34-0x00000000766C0000-0x00000000766E5000-memory.dmp

          memory/884-35-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-36-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-29-0x0000000077840000-0x00000000778BA000-memory.dmp

          memory/884-27-0x00000000766C0000-0x00000000766E5000-memory.dmp

          memory/884-21-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-22-0x0000000077840000-0x00000000778BA000-memory.dmp

          memory/884-23-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-24-0x0000000077840000-0x00000000778BA000-memory.dmp

          memory/884-26-0x0000000077840000-0x00000000778BA000-memory.dmp

          memory/884-25-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-20-0x0000000077840000-0x00000000778BA000-memory.dmp

          memory/884-14-0x0000000010000000-0x0000000010061000-memory.dmp

          memory/884-6-0x0000000000400000-0x000000000052E000-memory.dmp

          memory/3408-2-0x0000000000401000-0x0000000000412000-memory.dmp

          memory/3408-0-0x0000000000400000-0x0000000000428000-memory.dmp