Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:14

General

  • Target

    3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe

  • Size

    69KB

  • MD5

    2b6f4b3339f021aca6c7293eabd7bc8e

  • SHA1

    ce121199f23bd4dffbeb1d5a9df39c33a6991d05

  • SHA256

    3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7

  • SHA512

    57cb72b8c96e9def049ae689447355d7234fe6faca5bc11a62b70e74f3fa45e8b4a73f5cb25d90caee1e81ae72a125a2802b566756767d3cd2e68a06e3fe61af

  • SSDEEP

    1536:rAlWyGTYr+zEexLh9ixAFibDvmtkxHmsIY:py2lFX8bDetkxHDR

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe
    "C:\Users\Admin\AppData\Local\Temp\3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\WinGuido\GuidoAusili\GAStart.exe
      "C:\WinGuido\GuidoAusili\GAStart.exe" GASTARTCOUNT1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\WinGuido\GuidoAusili\GuidoAusili.exe
        "C:\WinGuido\GuidoAusili\GuidoAusili.exe" DASTART GASTARTCOUNT1 GASTARTCOUNT1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3240
        • C:\WinGuido\GuidoAusili\GAStart.exe
          "C:\WinGuido\GuidoAusili\GAStart.exe" GASTARTCOUNT1 GASTARTCOUNT1 GASTARTCOUNT2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1456
          • C:\WinGuido\GuidoAusili\GuidoAusili.exe
            "C:\WinGuido\GuidoAusili\GuidoAusili.exe" DASTART GASTARTCOUNT2 GASTARTCOUNT1 GASTARTCOUNT1 GASTARTCOUNT2
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4828
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4352
            • C:\WinGuido\GuidoAusili\GAStart.exe
              "C:\WinGuido\GuidoAusili\GAStart.exe" CHECK GASTARTCOUNT3
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3844
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath ""C:\WinGuido\GuidoAusili"""
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1168
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath ""C:\WinGuido\"""
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4736
            • C:\WinGuido\GuidoAusili\GABack.exe
              "C:\WinGuido\GuidoAusili\GABack.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1456
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
    1⤵
      PID:1980
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4f8 0x150
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1292

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GAStart.exe.log

      Filesize

      1KB

      MD5

      3bd24c67b3fd63ec5c6660c1f81089ba

      SHA1

      01a2ef2c0f615802a971546767c066b4bebb07e6

      SHA256

      86fe0bb2d64aecddb95d30c2fc51432123a56e3f159b5450d05e141ab8c14c01

      SHA512

      2c4be4202092df963dab3de3f963c0c4bf1894ea561c61d33027a274ffc1dff3bebfe3fe0d59cc8a4bbdb1f489f99664172f21ad9d97a91acc6ab00b0ad91325

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GuidoAusili.exe.log

      Filesize

      1KB

      MD5

      3ecbe9f7edb535445e6660f6829305b4

      SHA1

      fb338eb12b6957a6293bd95bdf2825d8ff9acac9

      SHA256

      a544980d23f5b61bfdf809668cc605fc81be8e0cbfc0ec1c602fe548c2df73c5

      SHA512

      f1461c5d2863e614db2254379670e122c7d923bf54622b11bd61d7fc919cfa7136c29621bacebe2f316b9955bfa4ee271d3d099d653f05802649ebb16a1f7b6e

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      70210e9bc08f6cb2a192ba8b6a232c0d

      SHA1

      fcb984dc65dbd12601e13a1269ec78e9fca5dc7c

      SHA256

      372baa4e8f861f72412e9316a7da4a6ddb29a3903d57cb2a4ae0baaa9f846c2e

      SHA512

      179f9b7985d16bac312b2e6b785e92e602280303c682becf7efd9edf357e383a8f8b53a248b937fb39ca9c91509a012ca2fe72aa296ba589af471118849d84a4

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epcv3qiz.qt2.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_2E6507A487AB43D2B3AA646F069653CD.dat

      Filesize

      940B

      MD5

      04139835f281a15b81b1bc9a5c2170a2

      SHA1

      ae89a9765ff3a0f6e163d974da691fdb1fba1945

      SHA256

      637650251f7e2f02b6674ce28354a27780bef7f95d31c687af257ec1429cc64f

      SHA512

      11a7dc68a911e86012dc30541f4a23e8bc0b6c470af34be59d67541488cd685f60c008af27f2fbbd3e05f56537c81f11c1e4977061d83b596fa61b2876ac46e3

    • C:\WinGuido\GuidoAusili\ALVAW32.DLL

      Filesize

      124KB

      MD5

      d3049bfab186cd87c5e25c041a2e39e5

      SHA1

      eb136d8fb0488878d6646eea3d65ce62cd5eb668

      SHA256

      8bdbea0849298df7842c1a5cd92b500d10e94306322ea52eaa1f98ed40516638

      SHA512

      05378a294e5a29def2b0f11983d9a0b30de58fd4897065de654528ffd59822e5c279bd0557e478bb404a19c41a4fc9443b557030231a8b5934af77a180ab229b

    • C:\WinGuido\GuidoAusili\Dati\0\Stringhe\Stringhe.ldb

      Filesize

      128B

      MD5

      e8a60e3ade1f90f23925f900eb179da2

      SHA1

      5ccc36c7cf3ff8256e09afe9d056b523916c47c8

      SHA256

      d830321397349076f39584138b5995e2768ac0842bf561650c089e3adf02badd

      SHA512

      81e79d1669db9cc1ac9fd5a8edeac573e14f4f095fc1f897da8c9a04e97efbc4234715f1f66dc4ba400c153fc950408eabeec176014f1f52f030fe76f7493643

    • C:\WinGuido\GuidoAusili\GAAgenda.dll

      Filesize

      161KB

      MD5

      acdba8c5d8662aba0145c46f6f5c839a

      SHA1

      857668c82e9235f081b777964068053562c15399

      SHA256

      644b40f1191fc88889ddafe2b286e0f74c647b94d1e98d1799de81c6eebb9ece

      SHA512

      899d9bba82d412a12906d9e518192159039e31be887301ad678ad21ce35ddbc2b027dd24db79abb9c64c3d839c9ffd9828ea675208ec6ed7135ddbb974b9d152

    • C:\WinGuido\GuidoAusili\GABack.exe

      Filesize

      23KB

      MD5

      a2e0cc453f3f9b0eda6fec6051121995

      SHA1

      c9cfe8f2dc243df4dbd8aefe7d325af28fd03dd6

      SHA256

      d40f06f1dd15ee7f18e8af277d09326c36667b03916f2548e899a8b57e6bbffe

      SHA512

      1464410bee02d4798d4167ebc57fd1a98baaeb3cbff8a50babd348fa128c9315d5798e740ec61b83a1db49b0642c134a55dd86a81553a892b079b8dec2fd0e2c

    • C:\WinGuido\GuidoAusili\GAChat.dll

      Filesize

      439KB

      MD5

      8ba5872919caa6c2812e7881f1d18414

      SHA1

      acc4c455452d67170d6b89e572cfdb1e098b9a85

      SHA256

      eb745145c55cb5d3b6d1ba17a2dbfd9ceeda3125c211dbd90773277e1f24bf49

      SHA512

      6b571fce97e2fd26ab7cf223ebe8d56f557863c45228f4e26002c7e8ee77eabae3a2debd138673e5307391333e65180d748bff20939ec8271c2c8924cf78d50c

    • C:\WinGuido\GuidoAusili\GAOCX.dll

      Filesize

      2.1MB

      MD5

      590afabdd9574b338516934d48ed9668

      SHA1

      05ea3c1c1131f7a898e7c6345c9dee3dfd37d8b4

      SHA256

      c1879a9d03a82e61e7741fcd737312b19d266fec9d7257b086ee5de499bbb726

      SHA512

      0d55966f07c90e445c18d43dcaf7736e9e84e3f566313b321689ff65f8288591552c176f857c7dae2b1fc2b5ad9e92aafc3c9c55194a520c63f903eef8c7e2cb

    • C:\WinGuido\GuidoAusili\GAPrincipale.dll

      Filesize

      191KB

      MD5

      e6e4f87c1828e67d5c5bcf778f1ad70e

      SHA1

      004ce674fb7ba50d2a3fa8fd600ffa7020150879

      SHA256

      37da3f7d024777426bbc5ccd882cadd0050c6296f513023b9f3c91a946d0c1b3

      SHA512

      e6eb06efcafd78d0ce9743a3ff001e9c0ed9b5057ffd313a38828315b94e8d440441ddb6d32fc55988e33f0f76480ec72d26f6fc66307a115ad0ac0c8164ffb5

    • C:\WinGuido\GuidoAusili\GAStart.exe

      Filesize

      28KB

      MD5

      177b1771a219d51bae8f6af2302ec2f0

      SHA1

      94a63a825ffde6f0162c5bf284fa7e87c118dbac

      SHA256

      8809840e6781e023dd8f7b725236780cf824690ca89301e4ef8b2d17e1297031

      SHA512

      c49b0b643e684bb0bad07ae8b395f6beaa1b0bcedcff16eeccccafe934da922cd710ae7bb45cafaea1a1ff891de57983cd6e52395b20b120527d97296d539a9b

    • C:\WinGuido\GuidoAusili\GuidoAusili.Log

      Filesize

      60B

      MD5

      68fe99ba82113d56be2d7771ddf122de

      SHA1

      28744137b5aaba539bf1722051b496ba1a2bcad1

      SHA256

      d31982219c247eaf362e75b4b35bed6149648d4ff96cfc5a6d2069069e1541c7

      SHA512

      b24542c437c41fcbcbb66a49db33fc38d989b6445c208456628c00c45c9dc92611e2c5b0647fe6c9f12cf8ce3668619392e606ea36a6dd614de4d74efd6e6e47

    • C:\WinGuido\GuidoAusili\GuidoAusili.exe

      Filesize

      69KB

      MD5

      65649c35f341359276e5a284146a4d4e

      SHA1

      4392be1b7fb3cf6ea46e12f025cc0af00b12e49d

      SHA256

      c1534cc27b181b0c684daaa68ee12d418af940d5aa3b1b181d734e4e64a7358d

      SHA512

      ce24442fff5f962e1745043b87a89f6869ee8584f641aec2b62e989460668ed9017a8054ade36df6f83f2ec9d39fa10ac7fce4dbde551c086fff7676775e00aa

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.exe.config

      Filesize

      4KB

      MD5

      5abf0e7c37e411a9dab0813df83b4158

      SHA1

      60ed29c7a91d54c4edbdfb4b957e91661abd9cd5

      SHA256

      d4385462ab483a473d84c563762ebd688b6fb53f10e9ad3f62d3c6199b3ea455

      SHA512

      cc8e28c13bdb7e56371963937c48b593cfaefcbf1a0c8b3f7ddc2696013312afbf34909fe6c1b88702c44f42cd9dd361f226c15e0c6b69cb2be743c08399f618

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.vshost.exe

      Filesize

      23KB

      MD5

      dbd8bc6438e1011ca1b796c7a9c78d78

      SHA1

      9184d63d8335efecf3ea02845fd1f027e7edaa0a

      SHA256

      280fdcaf69c8f7145446c8bc342fa4a0c7ff0abfed111c5f72b520f479fde785

      SHA512

      1536aa27db27c9ad52c4f5fcd5acd584a520afeb2bb30aaeca03682b3737fa7820fe0eb1d7a2e0951202e5383287edf8539b0939d2587a741729ab19c8f281f3

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.vshost.exe.config

      Filesize

      1KB

      MD5

      1ed5cc20071980ddc2f081af4d3be0a5

      SHA1

      548d12c8abf3a0b696487087fc2b370f52de455d

      SHA256

      18eac85da718d515287d97da93589d03acd793843b6256d27701992c66c8cc13

      SHA512

      57178babb9a98139e2954fcc9db0cf5b8b8871bb00747a9f3c827c0ed9293abe1c09a359575a3f28e2c2f8d092c808434640f01402bcca489d3916cb1b291495

    • C:\WinGuido\GuidoAusili\SLABHIDDevice.dll

      Filesize

      108KB

      MD5

      bf7c061d396c1399ec1446540d5221cc

      SHA1

      d5f356cd39d09ab737ab255f82e0e0c24ba891a0

      SHA256

      eb245fff873becd30b79260cac031d1c58bf93c6e7aa5a76d6bfac6cd1bcb411

      SHA512

      acdb828afabc41d54e5fed2737381b1ffd365783c293ba2a9cd0c3f8c41a6b537fee3e1d02c06a0513475570a313ce923bfb76e0b6f5fd46ecdea44a991e66e6

    • C:\WinGuido\GuidoAusili\SLABHIDtoUART.dll

      Filesize

      80KB

      MD5

      acf8a82427e1a19c15c0cc8ecf02d22c

      SHA1

      e1c5dcf600940dc5f418865b55a42a6b3c33d91c

      SHA256

      2226d189eed45887409670dbcfbfe5dc7f64b380f67e566123133166a4ac9754

      SHA512

      35df4a06036db2e4f49366852d193d31ee7d90ddd79c8c5f6723577674e7edb1f8046b15235d126f51baa33135f7fc4c6c76745a1ce70a848b41c275dc9f67f7

    • C:\WinGuido\GuidoAusili\SeikaDevice.dll

      Filesize

      23KB

      MD5

      563247eb3b6d2000b27cfaefe76d7393

      SHA1

      74460b9ccde7358dd50e6738009ebc67ad4dcc54

      SHA256

      8b8fbc194d4fad9454fd1c67dc9ce1374eb1027d4e22456577baa1e0f489d068

      SHA512

      da5ffc901dc4f267cdf53f912db5aab0707c56fc1e6eb86f73ecc94b99babfbc9fddff97827b9c0b860d7d40a320374b764aade4b794fd01b7d891ff5b66b85e

    • C:\WinGuido\GuidoAusili\Suoni\GAAttesa.wav

      Filesize

      236KB

      MD5

      b92eff9243f63eec5fb5675b30a0f324

      SHA1

      6b2a4b228c161bb92785e0e5a47f5bc9db2af44e

      SHA256

      356f6361960ad64834f87341aa3d14cde392e5ca6548ef906ecea01591d71cac

      SHA512

      aa66c5e9686dc146499fcb8277ca86c8058fd9f2c03ca2700aef8a12d960cd3dca92a8e0c1b0165e3e508c7fc7848900b40ecbb11a9a495909ba88b0e0179097

    • C:\WinGuido\GuidoAusili\lilli.dll

      Filesize

      51KB

      MD5

      1734919e44bc6924d99b3dc03d6afbcb

      SHA1

      77147382584151a0676b67ca47f4b27c022d2080

      SHA256

      9ced3f4811e31d71f12ebc72f94f046ef1f6fe9a15785ecc1b6635355cdec637

      SHA512

      ad7675206b7c00ab0ecd55d70b2039d7c22da4738fc111988ed8ec0546881bcc47066a400dc627846795d00bc394b2f1e59ad6c09ca6727b6102d4c4e65fc5e9

    • C:\WinGuido\GuidoAusili\wg~eci.dll

      Filesize

      304KB

      MD5

      0fbd8fdcc7bc662e4a9c8d57a9910170

      SHA1

      0a9ce715771a5b67ab4e2a70409195fd0f9dcd1d

      SHA256

      d6cd7483f0613d84466ee23aece16d872a065dc1ae61471f788fb7eaab97972d

      SHA512

      da3a5bdf1f7b96e1cd327acde2ac9deb43ad2cd904776e91c8e9d65460ebbce8d00a022f8e64ffcaa3ba0df82302fe1cfd6d92cefec04c3f8721b428d0631f77

    • memory/1168-124-0x0000000004FF0000-0x0000000005026000-memory.dmp

      Filesize

      216KB

    • memory/1168-235-0x0000000006B10000-0x0000000006B2E000-memory.dmp

      Filesize

      120KB

    • memory/1168-251-0x0000000007A80000-0x0000000007A91000-memory.dmp

      Filesize

      68KB

    • memory/1168-250-0x0000000007B00000-0x0000000007B96000-memory.dmp

      Filesize

      600KB

    • memory/1168-249-0x00000000078F0000-0x00000000078FA000-memory.dmp

      Filesize

      40KB

    • memory/1168-248-0x0000000007880000-0x000000000789A000-memory.dmp

      Filesize

      104KB

    • memory/1168-247-0x0000000007ED0000-0x000000000854A000-memory.dmp

      Filesize

      6.5MB

    • memory/1168-224-0x0000000006B30000-0x0000000006B62000-memory.dmp

      Filesize

      200KB

    • memory/1168-236-0x0000000006B80000-0x0000000006C23000-memory.dmp

      Filesize

      652KB

    • memory/1168-125-0x00000000056E0000-0x0000000005D08000-memory.dmp

      Filesize

      6.2MB

    • memory/1168-225-0x0000000070610000-0x000000007065C000-memory.dmp

      Filesize

      304KB

    • memory/1168-189-0x00000000065F0000-0x000000000660E000-memory.dmp

      Filesize

      120KB

    • memory/1168-131-0x0000000005EB0000-0x0000000005F16000-memory.dmp

      Filesize

      408KB

    • memory/1456-172-0x0000000000580000-0x000000000058C000-memory.dmp

      Filesize

      48KB

    • memory/3240-45-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3240-67-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3240-42-0x00000000003E0000-0x00000000003F6000-memory.dmp

      Filesize

      88KB

    • memory/4528-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

      Filesize

      4KB

    • memory/4528-22-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/4528-1-0x0000000000240000-0x0000000000256000-memory.dmp

      Filesize

      88KB

    • memory/4528-2-0x00000000050D0000-0x0000000005674000-memory.dmp

      Filesize

      5.6MB

    • memory/4528-3-0x0000000004B20000-0x0000000004BBC000-memory.dmp

      Filesize

      624KB

    • memory/4528-5-0x0000000004D00000-0x0000000004D92000-memory.dmp

      Filesize

      584KB

    • memory/4528-6-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/4528-7-0x0000000006590000-0x000000000659A000-memory.dmp

      Filesize

      40KB

    • memory/4736-266-0x00000000070D0000-0x00000000070D8000-memory.dmp

      Filesize

      32KB

    • memory/4736-265-0x00000000070F0000-0x000000000710A000-memory.dmp

      Filesize

      104KB

    • memory/4736-264-0x0000000006FF0000-0x0000000007004000-memory.dmp

      Filesize

      80KB

    • memory/4736-263-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

      Filesize

      56KB

    • memory/4736-237-0x0000000070610000-0x000000007065C000-memory.dmp

      Filesize

      304KB

    • memory/4828-86-0x0000000008110000-0x0000000008728000-memory.dmp

      Filesize

      6.1MB

    • memory/4828-88-0x00000000074F0000-0x000000000752C000-memory.dmp

      Filesize

      240KB

    • memory/4828-92-0x00000000099D0000-0x0000000009ADA000-memory.dmp

      Filesize

      1.0MB

    • memory/4828-221-0x000000000FF20000-0x000000000FF3C000-memory.dmp

      Filesize

      112KB

    • memory/4828-93-0x0000000009910000-0x0000000009938000-memory.dmp

      Filesize

      160KB

    • memory/4828-94-0x0000000009CE0000-0x0000000009D30000-memory.dmp

      Filesize

      320KB

    • memory/4828-291-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4828-194-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4828-215-0x000000000FEF0000-0x000000000FF05000-memory.dmp

      Filesize

      84KB

    • memory/4828-186-0x0000000008950000-0x0000000008971000-memory.dmp

      Filesize

      132KB

    • memory/4828-91-0x0000000009020000-0x0000000009374000-memory.dmp

      Filesize

      3.3MB

    • memory/4828-90-0x0000000007560000-0x00000000075AC000-memory.dmp

      Filesize

      304KB

    • memory/4828-89-0x0000000007540000-0x0000000007552000-memory.dmp

      Filesize

      72KB

    • memory/4828-83-0x0000000006E70000-0x0000000007086000-memory.dmp

      Filesize

      2.1MB

    • memory/4828-107-0x000000000A380000-0x000000000A3E6000-memory.dmp

      Filesize

      408KB

    • memory/4828-84-0x00000000075C0000-0x0000000007AEC000-memory.dmp

      Filesize

      5.2MB

    • memory/4828-279-0x0000000008B90000-0x0000000008BC6000-memory.dmp

      Filesize

      216KB

    • memory/4828-179-0x000000000FF70000-0x000000000FFD2000-memory.dmp

      Filesize

      392KB

    • memory/4828-174-0x000000000FC20000-0x000000000FC5C000-memory.dmp

      Filesize

      240KB

    • memory/4828-175-0x000000000FBE0000-0x000000000FC01000-memory.dmp

      Filesize

      132KB

    • memory/4828-110-0x000000000A770000-0x000000000A792000-memory.dmp

      Filesize

      136KB

    • memory/4828-121-0x000000000B090000-0x000000000B0A8000-memory.dmp

      Filesize

      96KB

    • memory/4944-25-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/4944-24-0x00000000002D0000-0x00000000002DE000-memory.dmp

      Filesize

      56KB

    • memory/4944-43-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/4944-23-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB